Extracted

• • Target

    d020daee98bb26f87e749c1d27cbfeebbf6e8d97a806b8507a40abf6bb7c00f8N

  • Size

    2.2MB

  • MD5

    57c5592f6f1395bb06bf3f34f977cd40

  • SHA1

    6b1f1ef7559ea159645425989a3c4700d84c0018

  • SHA256

    d020daee98bb26f87e749c1d27cbfeebbf6e8d97a806b8507a40abf6bb7c00f8

  • SHA512

    e99a6eccc95089773aab385c8f66cebaa53cc5ab58fea7a2293adc6e438c0ff7a5e94405cfcb9710fb4fb2acb2b560a66e034dca27db74491a5375b6b8a8f054

  • SSDEEP

    24576:iD39v74lfGQrFUspugRNJI2DJ53J/J/L5dJPjYF4ag/uI:ip7E+QrFUBgq2UI

  Score

  10^/10

  remcoshostdiscoverypersistenceratspywarestealer

  • Remcos

    Remcos is a closed-source remote control and surveillance software.

    ratremcos

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Adds Run key to start application

    persistence

  • Suspicious use of SetThreadContext

  behavioral1behavioral2