Extracted

• • Target
    2ae1341d4c27457829929138590f8416.exe
  • Size 2.1MB
  • SHA256 e0d4ce0316734fce0ea0d950f0ff1b4182f1364d581c549a199ac041cfe68ebb
  • MD5 2ae1341d4c27457829929138590f8416
  • SHA1 7c7c601a0d87d94faed5804fe93e79387b1389b1
  • SHA512 0576bae1574139e1734d9f298b15daea589a580400ef018e6353e9ba181f5be0e45d218b581260829f8718c49f11b20d04c19e4da7e8b6c217880e9b6a04ec8d
  • MD5 SHA1 SHA512

  Score

  10^/10

  remcospersistencerat

  • Remcos

    Remcos is a closed-source remote control and surveillance software.

    ratremcos

  • ServiceHost packer

    Detects ServiceHost packer used for .NET malware

  • Executes dropped EXE

  • Loads dropped DLL

  • Adds Run key to start application

    persistence

  • Suspicious use of NtSetInformationThreadHideFromDebugger

  • Suspicious use of SetThreadContext

  behavioral1behavioral2