Extracted

• • Target
    34991b7520110a2b781dbb5000fbe3194dd2d5bff9951f7d682afff40b4a91b8
  • Size 1.1MB
  • SHA256 34991b7520110a2b781dbb5000fbe3194dd2d5bff9951f7d682afff40b4a91b8
  • MD5 87c405e591beb831088d908dad3d5d79
  • SHA1 1bde488591b324ccd07416d805087944c1f64efe
  • SHA512 d8cea6ebdf272770cd4ba4f84d177fa9a80592b7028cc94b543dde7fae9d32aaadef840fc3272a544b50c5e02a88b90526b111f1863b394b7e95f8fdc505cef5
  • MD5 SHA1 SHA512

  Score

  10^/10

  remcospersistencerat

  • Remcos

    Remcos is a closed-source remote control and surveillance software.

    ratremcos

  • Suspicious use of NtCreateProcessExOtherParentProcess

  • ServiceHost packer

    Detects ServiceHost packer used for .NET malware

  • Executes dropped EXE

  • Loads dropped DLL

  • Adds Run key to start application

    persistence

  • Suspicious use of SetThreadContext

  behavioral1behavioral2