Extracted

Extracted

• • Target

    a7fab95ea927cb0689b8d40e1bb63790N.exe

  • Size

    2.2MB

  • MD5

    a7fab95ea927cb0689b8d40e1bb63790

  • SHA1

    0c76883e998efb9aca8604a00842d5a64960013c

  • SHA256

    d5ecd3f6efc58f4336dbf0682bf053114e84f95d4b37927eba9643b91e8f6789

  • SHA512

    c2d2995622352b6ffee6671de8a92138164e6e4c8c3b4d9680289a41b680fc1e4ff56b26b5ddefc758ca6d8f35708d334f524318ccb5c91dfff4791be30ae098

  • SSDEEP

    24576:sD39v74lfGQrFUspugRNJI2DJ53J/J/L5dJPjYF49rOoBlZ:sp7E+QrFUBgq2f3Z

  Score

  10^/10

  remcoshostcredential_accessdiscoverypersistenceratspywarestealer

  • Remcos

    Remcos is a closed-source remote control and surveillance software.

    ratremcos

  • Credentials from Password Stores: Credentials from Web Browsers

    Malicious Access or copy of Web Browser Credential store.

    credential_accessstealer

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Adds Run key to start application

    persistence

  • Suspicious use of SetThreadContext

  behavioral1behavioral2