Extracted

• • Target
    359ac8bb415a9af23c0ff8b6e39a868d32db5ad817cd7e577c85ab665709e634
  • Size 1.1MB
  • SHA256 359ac8bb415a9af23c0ff8b6e39a868d32db5ad817cd7e577c85ab665709e634
  • MD5 314192597d07cf8c85025cf35512f811
  • SHA1 163a89c5f9ce9bf10a085c3c7df4a3b6020efb97
  • SHA512 310ee97517aae1d74a0fa8028a91df832877b4d2890e90ecc4367176f269ed7ba4945aab982af4cb3c6597b6dc4fc1bfa8605d286023a20482ae91a19efb8df2
  • MD5 SHA1 SHA512

  Score

  10^/10

  remcospersistencerat

  • Remcos

    Remcos is a closed-source remote control and surveillance software.

    ratremcos

  • Suspicious use of NtCreateProcessExOtherParentProcess

  • ServiceHost packer

    Detects ServiceHost packer used for .NET malware

  • Executes dropped EXE

  • Loads dropped DLL

  • Adds Run key to start application

    persistence

  • Suspicious use of SetThreadContext

  behavioral1behavioral2