Extracted

Extracted

• • Target

    18a284f9269def1de29b66d8c26b53ea361c286cd4a2e981ea0cd53032a620a9

  • Size

    2.3MB

  • MD5

    329ae5cbe461e97d9ff4b20a0147ff55

  • SHA1

    bf8bf68d19980d63a779c1377a96459068d2940a

  • SHA256

    18a284f9269def1de29b66d8c26b53ea361c286cd4a2e981ea0cd53032a620a9

  • SHA512

    68b801614d9f78ba28676a906601610d0a9d62dbd529d0567f6b0f28aa2ee7e96428009c0c925a7af13b312be7e50257da2259a0e4f8f4efbd66d526692bd9b0

  • SSDEEP

    24576:pD39v74lfGQrFUspugRNJI2DJ53J/J/L5dJPjYF49rO/B:pp7E+QrFUBgq2m

  Score

  10^/10

  remcoshostdiscoverypersistenceratspywarestealer

  • Remcos

    Remcos is a closed-source remote control and surveillance software.

    ratremcos

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Adds Run key to start application

    persistence

  • Suspicious use of SetThreadContext

  behavioral1behavioral2