Extracted

Extracted

• • Target

    9f3af8ec4639e404895b10e9b9a59440N

  • Size

    2.0MB

  • MD5

    9f3af8ec4639e404895b10e9b9a59440

  • SHA1

    539cc1d9970dad430090fa13a55c12ada6886950

  • SHA256

    1731c2d1843b004c1a5c7c21b2eb89530a47ab8d72319b1a3fd4a9ae3e237d78

  • SHA512

    f72fbf4234e8ccd932b37487a9d90ade6972928a21987066addc2b6de9d6eb4a47ca225ae54b0170e84ac448ad9607969af2a2d63b5d94fb06f41e25eb34fdfd

  • SSDEEP

    24576:KD39v74lfGQrFUspugRNJI2DJ53J/J/L5dJPj8/j73AneLww5:Kp7E+QrFUBgq2q

  Score

  10^/10

  remcoshostdiscoverypersistenceratcredential_accessspywarestealer

  • Remcos

    Remcos is a closed-source remote control and surveillance software.

    ratremcos

  • Credentials from Password Stores: Credentials from Web Browsers

    Malicious Access or copy of Web Browser Credential store.

    credential_accessstealer

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Adds Run key to start application

    persistence

  • Suspicious use of SetThreadContext

  behavioral1behavioral2