Extracted

• • Target
    5737766edb73affc8fff5873f8e29e68ff381f2873f95e6ac0433bb5550d5f5a
  • Size 2.9MB
  • SHA256 5737766edb73affc8fff5873f8e29e68ff381f2873f95e6ac0433bb5550d5f5a
  • MD5 850416397e693cf81e0c26e36525fa8b
  • SHA1 9913847e0fe23a7ee0d46b60b60ac3256b3f9afe
  • SHA512 1ffa56c45cdc458540e8c164b793d5b433ea1affa9c7690efcf1605421841b77088ccaa40fe4570d692faa7ee70448b666154d04e593fec3cf4f6793b8d0bfa6
  • MD5 SHA1 SHA512

  Score

  10^/10

  remcospersistenceratupx

  • Remcos

    Remcos is a closed-source remote control and surveillance software.

    ratremcos

  • Suspicious use of NtCreateProcessExOtherParentProcess

  • ServiceHost packer

    Detects ServiceHost packer used for .NET malware

  • Executes dropped EXE

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx

  • Loads dropped DLL

  • Adds Run key to start application

    persistence

  • Suspicious use of SetThreadContext

  behavioral1behavioral2