Extracted

Extracted

• • Target

    7cc14c13ddf6719afb12d3ef8f7ebe89de36ab0fb15fb0c2c908383f44f53c7b.exe

  • Size

    1.3MB

  • MD5

    296210b871033b6c400f50bc5e4b0638

  • SHA1

    a9e200a98c2eea22ff9a546a6904f2895f6d1203

  • SHA256

    7cc14c13ddf6719afb12d3ef8f7ebe89de36ab0fb15fb0c2c908383f44f53c7b

  • SHA512

    19c97a796f4e1da228f894f3aa8f43098cc5843bc54ec32580a13255399d92e500c04ed4eb10756b886f0bb7e221e4d46943b317403dd440c2ae52d0dda9281d

  • SSDEEP

    24576:JiaHUIP+zim0kt3nX+cNvcV79UvXJLewyRMXjjBerMPuCa3eZPa+9Y8iMo6bt:0aHUIP+VpbJi9UR6sjBerMmC3u8iMJ

  Score

  10^/10

  latentbotremcosfeb 13discoveryexecutionrattrojan

  • LatentBot

    Modular trojan written in Delphi which has been in-the-wild since 2013.

    trojanlatentbot

  • Latentbot family

    latentbot

  • Remcos

    Remcos is a closed-source remote control and surveillance software.

    ratremcos

  • Remcos family

    remcos

  • Command and Scripting Interpreter: PowerShell

    Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

    execution

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2