Extracted

Extracted

• • Target

    679104fb0479ff61c4b5e4b88f77d94b.exe

  • Size

    6KB

  • MD5

    679104fb0479ff61c4b5e4b88f77d94b

  • SHA1

    bfbcb5d48fb4ab25d52e4e1bedf37a4e7a4a3cab

  • SHA256

    4134bd82bbea78103d0e32728df856870eaa2c0188b59423115c7d779b2bf83a

  • SHA512

    7cb36200865267885939956614a7b8603cd16575a3857e0ecc238ff22d296b29bfb208bb11f61f3856278f6b4585afdb2c8456d2f2630f0fbc33fa298df0253e

  • SSDEEP

    192:zU3efq7iEM9gdH98dfQbLE5lF22vjWwID:Q3efq7iEM9gdH98dfgLE5lI2vjlI

  Score

  10^/10

  purecrypterdownloaderloaderremcosremotehostpersistencerat

  • PureCrypter

    PureCrypter is a .NET malware loader first seen in early 2021.

    loaderdownloaderpurecrypter

  • Remcos

    Remcos is a closed-source remote control and surveillance software.

    ratremcos

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Adds Run key to start application

    persistence

  • Suspicious use of SetThreadContext

  behavioral1behavioral2