Extracted

• • Target

    ADJUNTO_EXTRACTO_57971132761620070018881_09935417206929246064486_21739530852328700789183845_619471746722927151121122_pdf

  • Size

    179KB

  • MD5

    f18ecb4ec01c8696b450b53e255f8e32

  • SHA1

    18e24ceb9004c164db0d204d9ca513b5a64060fa

  • SHA256

    b805f68139469a793d97d7082a7d46a5eedcea8fa39676fd4ce557dae2725fff

  • SHA512

    59f5c4616b17aaeba753318fcffacba71dc76bcc599665e31a50e7d31026ed2edc598bd285b1de9e19a09e9a6987318be3f17cee827a7b7ce2a89e6385d8f36d

  Score

  10^/10

  remcosevasionpersistencerattrojan

  • Modifies Windows Defender Real-time Protection settings

    evasiontrojan

  • Remcos

    Remcos is a closed-source remote control and surveillance software.

    ratremcos

  • Turns off Windows Defender SpyNet reporting

    evasion

  • Windows security bypass

    evasiontrojan

  • Nirsoft

  • Executes dropped EXE

  • Loads dropped DLL

  • Windows security modification

    evasiontrojan

  • Adds Run key to start application

    persistence

  • Suspicious use of SetThreadContext

  behavioral1behavioral2