Extracted

• • Target

    7af1c536e0fe8a4db1373de6b8005bff485084c28d36a37cb46052d41c609708

  • Size

    2.1MB

  • MD5

    18f67d707146fc908455ef5d16d6767f

  • SHA1

    2f5d33f14155769ca54f4aee09d7efc2c41dcc7d

  • SHA256

    7af1c536e0fe8a4db1373de6b8005bff485084c28d36a37cb46052d41c609708

  • SHA512

    a06f78dc341d8f816dd3dfee5b54f82c43e6dbd212777174a9d812a9051be55b823c0f085b860e68735efd24d7bd4d01bad8b9c557551b46b740bc439dd77fef

  • SSDEEP

    24576:3D39v74lfGQrFUspugRNJI2DJ53J/J/L5dJPjYF4avnXJJjc:3p7E+QrFUBgq2Sng

  Score

  10^/10

  remcoshostdiscoverypersistenceratspywarestealer

  • Remcos

    Remcos is a closed-source remote control and surveillance software.

    ratremcos

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Adds Run key to start application

    persistence

  • Suspicious use of SetThreadContext

  behavioral1behavioral2