Extracted

• • Target

    Factura Serfinanza_091060156_57614532_47411165355359140_4125802_77434958822958585231_35731076880_pdf.exe

  • Size

    1.8MB

  • MD5

    e13f7ded8bfc14808ca964c5dec10b9f

  • SHA1

    c5606c21b84a858ed7b54da2a7f17802fffcddb3

  • SHA256

    e8cac456b3e4a072d16142f0dd9f9b0500013cfefe7359e4293d4cff61f9eaf7

  • SHA512

    91d0cfb0e051c3ab5f8b97a5d8afb83476d825d7e87760a93220fd44cfd42c93b6b394341924521202988595e1a787586c087b614d8ab7df42563ccc2b490e7d

  Score

  10^/10

  remcospersistencerat

  • Remcos

    Remcos is a closed-source remote control and surveillance software.

    ratremcos

  • Executes dropped EXE

  • Loads dropped DLL

  • Adds Run key to start application

    persistence

  • Suspicious use of NtSetInformationThreadHideFromDebugger

  • Suspicious use of SetThreadContext

  behavioral1behavioral2