Extracted

• • Target

    d12fc581fb473cb6b22b253f4a26f3780063970442a18cd27a299c750ad6e221N

  • Size

    2.0MB

  • MD5

    a3306a8ffe614d6c05c81226e66bd7e0

  • SHA1

    8c9d52d17df3b2556d4b4f15a191851a15afe188

  • SHA256

    d12fc581fb473cb6b22b253f4a26f3780063970442a18cd27a299c750ad6e221

  • SHA512

    80cbbfd7b1eb0ff09da0250a93576df301064eedad21e95074b3eb1ec0a6b968277bf93c300183844df1c873cd308e93090683261b6b443e8f0c2eb5e63cd128

  • SSDEEP

    24576:gD39v74lfGQrFUspugRNJI2DJ53J/J/L5dJPj8/j7otSm/EVjlM:gp7E+QrFUBgq2pqM

  Score

  10^/10

  remcoshostdiscoverypersistenceratspywarestealer

  • Remcos

    Remcos is a closed-source remote control and surveillance software.

    ratremcos

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Adds Run key to start application

    persistence

  • Suspicious use of SetThreadContext

  behavioral1behavioral2