Extracted

Extracted

• • Target

    1d4ab01e60e8a249065a033140266ba6352eb21be73c0bd625ccb6881152db39.exe

  • Size

    1.5MB

  • MD5

    d9917d45e9c92f10c148b7cdf3a4a54e

  • SHA1

    230b29f575e5a203f0ed6ae37ac0f4bc2eca14ee

  • SHA256

    1d4ab01e60e8a249065a033140266ba6352eb21be73c0bd625ccb6881152db39

  • SHA512

    fd8618b7b4f13e1ebbb2d6cc29ee2c9709c652052318dab2d2f4d558bbede2ba16c58a93e436bbb6e89d80095568e650eab131bb859f2437ff7f1235f160b129

  • SSDEEP

    24576:+D39dlfGQrFUspugRNJI2DJnUw9W/j+BeKJWq8:+F+QrFUBgq25eKe

  Score

  10^/10

  remcoshostdiscoverypersistenceratspywarestealer

  • Remcos

    Remcos is a closed-source remote control and surveillance software.

    ratremcos

  • Remcos family

    remcos

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Adds Run key to start application

    persistence

  • Suspicious use of SetThreadContext

  behavioral1behavioral2