Extracted

• • Target

    6e6706f6cc72d8b64a5014acc09ec78d7a6a92b0de7e6a2541e013e8bee6ab06

  • Size

    1.4MB

  • MD5

    4275510e24328f7c334cf5e9ddb0a7f7

  • SHA1

    0ab0a35c80f75bbcf483ac5837e72c790dec1198

  • SHA256

    6e6706f6cc72d8b64a5014acc09ec78d7a6a92b0de7e6a2541e013e8bee6ab06

  • SHA512

    473a446db945beb5748d556177cd57d637d3756a83e2e3ef7180eb27f5f4a25fff77347638666891e591a98bcb72ae71b92fa608591286d0e7bcb3fdd94b4a85

  • SSDEEP

    24576:YD39dlfGQrFUspugRNJI2DJnUw9W/j+BeKJF:YF+QrFUBgq25eK7

  Score

  10^/10

  remcoshostdiscoverypersistenceratspywarestealer

  • Remcos

    Remcos is a closed-source remote control and surveillance software.

    ratremcos

  • Remcos family

    remcos

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Adds Run key to start application

    persistence

  • Suspicious use of SetThreadContext

  behavioral1behavioral2