Extracted

• • Target
    2b554ef8cede0aaf90b2eba967599dede6795344ae5c7e876e5c3a5776894a16
  • Size 1.1MB
  • SHA256 2b554ef8cede0aaf90b2eba967599dede6795344ae5c7e876e5c3a5776894a16
  • MD5 6baf52b941389d943af311234227adce
  • SHA1 05edcb00cc2d8ecea1370819c7e233803e475482
  • SHA512 fc5bf18f34c0e328854ff686f7c8e08e9658d6ebd5c454b3ffd0f6dd42e11853593506a0ca35318b16418968eafa109091bff5a310410080f74fe0ffc8421f7a
  • MD5 SHA1 SHA512

  Score

  10^/10

  remcospersistencerat

  • Remcos

    Remcos is a closed-source remote control and surveillance software.

    ratremcos

  • Suspicious use of NtCreateProcessExOtherParentProcess

  • ServiceHost packer

    Detects ServiceHost packer used for .NET malware

  • Executes dropped EXE

  • Loads dropped DLL

  • Adds Run key to start application

    persistence

  • Suspicious use of SetThreadContext

  behavioral1behavioral2