Extracted

• • Target

    75288df36386c8ce9ad16ff78d6cf3ca.exe

  • Size

    1.3MB

  • MD5

    75288df36386c8ce9ad16ff78d6cf3ca

  • SHA1

    3f8553a2bfeac57bb76cb4e2050d3aa7fa0a111a

  • SHA256

    86c9b8f7003a77106c1746a855da645783d6ed30fffa45350554ab2edd0e1290

  • SHA512

    7701c1630fa0c19afb98321dc9af635e64080dcbefb356f95051165e84dd27405a919a8ae77e5d38a568a7ce24b9977cd61c45920315c82a73b760080704b0f6

  Score

  10^/10

  remcospersistencerat

  • Remcos

    Remcos is a closed-source remote control and surveillance software.

    ratremcos

  • Executes dropped EXE

  • Loads dropped DLL

  • Adds Run key to start application

    persistence

  • Suspicious use of NtSetInformationThreadHideFromDebugger

  • Suspicious use of SetThreadContext

  behavioral1behavioral2