Extracted

• • Target
    Cobro Juridico_0565048607_5104702_23918226873513229_945916769_9361784995141114_659091236144_pdf.exe
  • Size 2.0MB
  • SHA256 ea7caecf45fc75ba512efd3cf878800893c2a43ae66fc0a9a452687ba26c1025
  • MD5 4dfc3cf849a698f44db1e5599191e517
  • SHA1 82ca8a7f0cc21fdb8b9840254d9386a7bbb35ae6
  • SHA512 4731e5713a1f674c4f2af660e7ac876376da5d3b281a7b659deb10a72fbb9d8b432de2a5ce341a42f05f61c44fdd8f58d63daeda2bc04a38759b549973ce490f
  • MD5 SHA1 SHA512

  Score

  10^/10

  remcospersistencerat

  • Remcos

    Remcos is a closed-source remote control and surveillance software.

    ratremcos

  • ServiceHost packer

    Detects ServiceHost packer used for .NET malware

  • Executes dropped EXE

  • Loads dropped DLL

  • Adds Run key to start application

    persistence

  • Suspicious use of NtSetInformationThreadHideFromDebugger

  • Suspicious use of SetThreadContext

  behavioral1behavioral2