Extracted

Extracted

• • Target
    46d9ae53ad8530ddecbaa73c29c89ae0N.exe
  • Size 2.0MB
  • SHA256 89152e203c42a292a86b5ed9d4d4f99260b9ddd2fc45280846140947b874ed9c
  • MD5 46d9ae53ad8530ddecbaa73c29c89ae0
  • SHA1 887d829711821f146a049aff952dfdbe075e7ad8
  • SHA512 4329fba2a8d4b85029de76350992281126b6e66c75ea1a8f34fa5da9f3ed9318df01a73806116700a51d82a420a539f7573098e542388ead1925e38aa971ec7d
  • SSDEEP 24576:QD39v74lfGQrFUspugRNJI2DJ53J/J/L5dJPjYF4+vL:Qp7E+QrFUBgq2a
  • MD5 SHA1 SHA512 SSDEEP

  Score

  10^/10

  remcoshostpersistenceratspywarestealer

  • Remcos

    Remcos is a closed-source remote control and surveillance software.

    ratremcos

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Adds Run key to start application

    persistence

  • Suspicious use of SetThreadContext

  behavioral1behavioral2