Extracted

• • Target
    3ec6d00a4d3dbb78e50ec84b113f8cc3b254b974ce0218c5bf840e662e7a416b
  • Size 2.9MB
  • SHA256 3ec6d00a4d3dbb78e50ec84b113f8cc3b254b974ce0218c5bf840e662e7a416b
  • MD5 3a198cef1e0a5b7c0496e34f9b8f7a78
  • SHA1 8119647a15ad10d8ba0e96d9228a081e8ebe9590
  • SHA512 1a14e0217ee2119e521d74f4603d6fe24177ca6a4bf1521b207e66e69cf017f93156bfbfb29f02c9b37344a93f3eae4743f0fdfa33ee8229e049543cb6b4c20d
  • MD5 SHA1 SHA512

  Score

  10^/10

  remcospersistenceratupx

  • Remcos

    Remcos is a closed-source remote control and surveillance software.

    ratremcos

  • Suspicious use of NtCreateProcessExOtherParentProcess

  • ServiceHost packer

    Detects ServiceHost packer used for .NET malware

  • Executes dropped EXE

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx

  • Loads dropped DLL

  • Adds Run key to start application

    persistence

  • Suspicious use of SetThreadContext

  behavioral1behavioral2