Extracted

• • Target

    d950eb5505a609d0fc10edeb2db67120b35a6b9e977c343265d6b64e1c8e5afcN

  • Size

    2.3MB

  • MD5

    e2caad70b5d038f04b8616f8054cab50

  • SHA1

    cd899cd6abfbfacdcf7dd564f24fd684976345ba

  • SHA256

    d950eb5505a609d0fc10edeb2db67120b35a6b9e977c343265d6b64e1c8e5afc

  • SHA512

    1fbfd629880dfd0709a83dc02fc72d7505acc9fa8c75cedd01eba53130bc220f93d3badf1d99f45948d9ad0a80c6aa851d3f43c7e9879411792cb48d10c03088

  • SSDEEP

    24576:UD39v74lfGQrFUspugRNJI2DJ53J/J/L5dJPjYF4avnXJJJz5/2:Up7E+QrFUBgq2Sn7/2

  Score

  10^/10

  remcoshostdiscoverypersistenceratspywarestealer

  • Remcos

    Remcos is a closed-source remote control and surveillance software.

    ratremcos

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Adds Run key to start application

    persistence

  • Suspicious use of SetThreadContext

  behavioral1behavioral2