Extracted

• • Target

    pago.bcp.pdf.exe

  • Size

    1.4MB

  • MD5

    092beeec1cfbe99c40299d954bacc8da

  • SHA1

    55d56f40c256fa3eab78e3a58d5584894393e673

  • SHA256

    a0805b60c79c0edd1b7acee3ab9dc807e1c065c4c2575bceefe0ccf7f6524471

  • SHA512

    0515b42cf01c247f4096fd50df8c4f28c61bd378b7ebf11c02aca9fad0cca34c7f48eca5f1ecd3641be17e89d08b71569ee52934313c1b86b8f3280e985a0814

  • SSDEEP

    24576:KSEM0TpgTCUTJEjSE80TtgTHUTRrL63LYi+t/eW5934XskzuoUuOxtHmURi3AEFV:XkRcskzUuytHmz3AE

  Score

  10^/10

  discoveryremcosremotehostpersistencerat

  • Remcos

    Remcos is a closed-source remote control and surveillance software.

    ratremcos

  • Suspicious use of NtCreateUserProcessOtherParentProcess

  • Adds Run key to start application

    persistence

  • Suspicious use of SetThreadContext

  behavioral1behavioral2