Extracted

• • Target

    purchase order for july.exe

  • Size

    531KB

  • MD5

    2b8ffa3d1e175136dbecbc64b2562294

  • SHA1

    1f9f9a709fc9565ffea8b3f3a655a607aff03d28

  • SHA256

    74c74bc92e1e2b1fbec04160533ddc46adfd8e2f691295ad4a08cbd83e01adc7

  • SHA512

    be86d9ffca14908d42a7782664eb6eabc669c2b25ec6dd3ad332b934c860a7513773e6e85de1e084d3965ac839959b546a77dbf81e3526dc698e94386bc74802

  Score

  10^/10

  persistenceratremcos

  • Remcos

    Remcos is a closed-source remote control and surveillance software.

    ratremcos

  • Executes dropped EXE

  • Loads dropped DLL

  • Adds Run entry to start application

    persistence

  • Suspicious use of SetThreadContext

  behavioral1behavioral2