Extracted

• • Target
    SecuriteInfo.com.Generic.mg.c256502f66dbd289.10792
  • Size 1.7MB
  • SHA256 facf1bd37fa739f82bc10a7a6e7436b4871af89e3c8389270673e2dbb76200e4
  • MD5 c256502f66dbd289955472b574432271
  • SHA1 d7adee8673f92b59bfdaaa598ab41e04a2226ba8
  • SHA512 f6042d1bec0de3bc025c8aa525b2ad2c9f2d9fcd6c0a6446ba589b5b2ba1852621e65af69bf961bfa313df4451fb16974a406e02c0f391e30fd64c51f0a5be80
  • MD5 SHA1 SHA512

  Score

  10^/10

  remcospersistenceratspyware

  • Remcos

    Remcos is a closed-source remote control and surveillance software.

    ratremcos

  • Executes dropped EXE

  • Loads dropped DLL

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spyware

  • Adds Run key to start application

    persistence

  • Suspicious use of NtSetInformationThreadHideFromDebugger

  • Suspicious use of SetThreadContext

  behavioral1behavioral2