Extracted

• • Target
    ACTION2021.scr
  • Size 1.4MB
  • SHA256 c39bdd8f7c69c3140ef920e2b1d5965310058c5fa425b871f4d7751d8291d55e
  • MD5 c6ed7e791f0c36826d3c55e196dd7bd4
  • SHA1 97e94a141b7d479fd14373f724ce3232c2b0c429
  • SHA512 17b21afde88b6d4ebb2340da7fb506ee62da93172e62e8da7bd4cf505fbe0df305f65523b555b9804d938411f00571a2718ec4ca900482c264173e2a42121a4f
  • MD5 SHA1 SHA512

  Score

  10^/10

  remcosevasionpersistenceratspywaretrojan

  • Remcos

    Remcos is a closed-source remote control and surveillance software.

    ratremcos

  • UAC bypass

    evasiontrojan

  • Executes dropped EXE

  • Loads dropped DLL

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spyware

  • Adds Run key to start application

    persistence

  • Suspicious use of SetThreadContext

  behavioral1behavioral2