Extracted

Extracted

• • Target

    3f97d2a4e5b5a16d9607fe9dfb7ca2c0N.exe

  • Size

    2.2MB

  • MD5

    3f97d2a4e5b5a16d9607fe9dfb7ca2c0

  • SHA1

    6264e3311d3c3b0b2ee7b866c3d0a1452031d5e4

  • SHA256

    c46e7b8033aac457b4387c32fba170baf72bfb5a0b378523b225cc51d7f2f92d

  • SHA512

    9b1c08df12092774e82f7a2b4c3196eb9a56796581f73ecd321582106254791a48216d448d91f966fc64017ae2e6b0dca116e421d56a8b515a8768857e0cb44c

  • SSDEEP

    24576:mD39v74lfGQrFUspugRNJI2DJ53J/J/L5dJPjYF4avnXJmFu:mp7E+QrFUBgq2Snau

  Score

  10^/10

  remcoshostcredential_accessdiscoverypersistenceratspywarestealer

  • Remcos

    Remcos is a closed-source remote control and surveillance software.

    ratremcos

  • Credentials from Password Stores: Credentials from Web Browsers

    Malicious Access or copy of Web Browser Credential store.

    credential_accessstealer

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Adds Run key to start application

    persistence

  • Suspicious use of SetThreadContext

  behavioral1behavioral2