Extracted

• • Target

    Enquiry_Order_Official_Quotation.exe

  • Size

    2.5MB

  • MD5

    e1c771cceb693ea14bbcde32ac1355fc

  • SHA1

    bc2da06db4b0cc42595b7761ff990e303441cd99

  • SHA256

    70a0d6207bf07b9d71452c71fc65c9b8335d2099796d70a25ec6f2a03090daa9

  • SHA512

    fcbb24d7f938145fb82bd6d1d609a4416d78a9285499078ddabf558cac050319bac06c2b6fccdea3ec558e71c5589fb2bc76c6bee6cb4d02dd2691ded8ef2eff

  • SSDEEP

    24576:CsLDsY5ohQjNm5lGrJrGU/thfLixwfA7DgCBbZoiSNy5aKg88vX6yqlAtVULkfSO:C3FYVr4U/3L7yRAUQKuakLomg0BqKqw

  Score

  10^/10

  purecrypterremcosikmerro2023downloaderloaderpersistencerat

  • Detect PureCrypter injector

    loader

  • PureCrypter

    PureCrypter is a .NET malware loader first seen in early 2021.

    loaderdownloaderpurecrypter

  • Remcos

    Remcos is a closed-source remote control and surveillance software.

    ratremcos

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Adds Run key to start application

    persistence

  • Suspicious use of SetThreadContext

  behavioral1behavioral2