Extracted

• • Target

    cdee0f0c53b0cec377c5742953542e130f6b7fbd0d5138aefa9cda029bc66231N.exe

  • Size

    1.0MB

  • MD5

    70468aa533db2ae27fbfc623ee425590

  • SHA1

    3467409c6e6995f8bf6deea847880d6a56d029d3

  • SHA256

    cdee0f0c53b0cec377c5742953542e130f6b7fbd0d5138aefa9cda029bc66231

  • SHA512

    1f2c35b46a86391aa392ee5a6ac88e798e29bb313f48d25bd4b8c315c3b049373d0d9e8710f4c58861c5357b0f6df0680d436f1098b7f2e5a14f2dbcdf7c3bc5

  • SSDEEP

    12288:PfeDOa9rDeYSorINpj5XqkJD0QrOod7XxlW91RRep+rgRNyA55IxJ2DJW//oj/W:uD39v74lfGQrFUspugRNJI2DJW//ojO

  Score

  10^/10

  remcoshostdiscoverypersistenceratspywarestealer

  • Remcos

    Remcos is a closed-source remote control and surveillance software.

    ratremcos

  • Remcos family

    remcos

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Adds Run key to start application

    persistence

  • Suspicious use of SetThreadContext

  behavioral1behavioral2