Extracted

Extracted

• • Target

    NEAS.1109042c3f41ad8b2b37562004c61130_JC.exe

  • Size

    1.1MB

  • MD5

    1109042c3f41ad8b2b37562004c61130

  • SHA1

    b198c98a92b13396bf7de61487d61e86bc6a13d4

  • SHA256

    115eecb607fdaf63fa831cc0ec169c2efa99a31f690ba2d43ebe15c58d958a42

  • SHA512

    5be01e9d10904fbda94e9d92dd86ffbb7033a77d9d6880f5759cdb04b9b01339728319b61f1d9378423b2ffa513d615385258d546ef0ca8c1b4e9e4edd5145c1

  • SSDEEP

    12288:OfeDOa9rDeYSorINpj5XqkJD0QrOod7XxlW91RRep+rgRNyA55IxJ2DJ53J/J/Z:FD39v74lfGQrFUspugRNJI2DJ53J/J/Z

  Score

  10^/10

  remcoshostpersistenceratspywarestealer

  • Remcos

    Remcos is a closed-source remote control and surveillance software.

    ratremcos

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Adds Run key to start application

    persistence

  • Suspicious use of SetThreadContext

  behavioral1behavioral2