Extracted

• • Target

    e98307f10fb1d21c36c2a1104288cd0ce29684490e591df56bdd362cf6afc124N.exe

  • Size

    1.4MB

  • MD5

    7db1a0b67a4f30a44b64919b8ab85280

  • SHA1

    b0d7831aa9191eeb2a3c2ff2f5784cea63262305

  • SHA256

    e98307f10fb1d21c36c2a1104288cd0ce29684490e591df56bdd362cf6afc124

  • SHA512

    3d4de1d54d527ee1c750202e2d24bf10c20fcd65b24b50deec051dee61446bd375d85aa291462aab39c99109563db7f39e2d1a488ce669252458bbc95439eecd

  • SSDEEP

    24576:gD39dlfGQrFUspugRNJI2DJnUw9W/j+BeKJ3U:gF+QrFUBgq25eKZU

  Score

  10^/10

  remcoshostdiscoverypersistenceratspywarestealer

  • Remcos

    Remcos is a closed-source remote control and surveillance software.

    ratremcos

  • Remcos family

    remcos

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Adds Run key to start application

    persistence

  • Suspicious use of SetThreadContext

  behavioral1behavioral2