Extracted

• • Target

    af2d72fc2c8e4b4a6b7be2d7b5806d37ffc13b27d2a210ffffcc8c963862e184.exe

  • Size

    2.6MB

  • MD5

    a5bee6a7836dcd947ff0159da4ca0b29

  • SHA1

    9f86f98d5777bc73753cc5a70a2f259b8e1b9e82

  • SHA256

    af2d72fc2c8e4b4a6b7be2d7b5806d37ffc13b27d2a210ffffcc8c963862e184

  • SHA512

    6afc31772009ed4ee6e4ba9733b563bc379a47491cea633054cdce4e6f8798456d202171f212b3572e6d88c90d6d8a1ffff5f484707e5186e0b170ab6f8167e7

  • SSDEEP

    49152:PYbdYAm4zEbdYAm4zXbdYAm4zKbdYAm4zFbdYAm4zB3An3AI3AJ3AiW538r/39vG:PSdrWdrrdrAdr1drlA3AaAtAuv9vpn43

  Score

  10^/10

  discoveryremcosmranon2025gadwarepersistenceprivilege_escalationratstealer

  • Remcos

    Remcos is a closed-source remote control and surveillance software.

    ratremcos

  • Remcos family

    remcos

  • Boot or Logon Autostart Execution: Active Setup

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

    persistence

  • Downloads MZ/PE file

  • Event Triggered Execution: Component Object Model Hijacking

    Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.

    persistenceprivilege_escalation

  • Executes dropped EXE

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery

  • Installs/modifies Browser Helper Object

    BHOs are DLL modules which act as plugins for Internet Explorer.

    stealeradware

  • Drops file in System32 directory

  • Suspicious use of NtSetInformationThreadHideFromDebugger

  • Suspicious use of SetThreadContext

  behavioral1behavioral2