Extracted

• • Target
    gyns.exe
  • Size 385KB
  • SHA256 67f5353bdabe4d52ecb054b0ef0bd7faa2bc647843b56d3fab36e749b98a1e09
  • MD5 28ee784e4cbd74c8a15b7064c89e570a
  • SHA1 8c82cfb8ab85948131872c3abf504cbf4dbbc52d
  • SHA512 38564f12d9ad743aa8eb1bddbe3fec097eb6d3dbe16d95736037b1efb98e1970eea90f4dda0e420978fb7f262efe86edcf5aedc25cd6a994fbbe2fe93bba0e64
  • MD5 SHA1 SHA512

  Score

  10^/10

  agilenetpersistenceremcosrat

  • Modifies WinLogon for persistence

    persistence

  • Remcos

    Remcos is a closed-source remote control and surveillance software.

    ratremcos

  • Executes dropped EXE

  • Loads dropped DLL

  • Obfuscated with Agile.Net obfuscator

    Detects use of the Agile.Net commercial obfuscator, which is capable of entity renaming and control flow obfuscation.

    agilenet

  • Adds Run key to start application

    persistence

  • Modifies WinLogon

    persistence

  • Drops file in System32 directory

  • Suspicious use of SetThreadContext

  behavioral1behavioral2