Extracted

Extracted

• • Target

    dfc6da93f93521375a1c87f8a99b069c4440939f93d7bf90cf30c140eec0df4bN.exe

  • Size

    903KB

  • MD5

    48bd99be6b0f63e8f6cb8222275f6080

  • SHA1

    3f2a535aff3d26f6bb3bd799a8f5a8dbcd286458

  • SHA256

    dfc6da93f93521375a1c87f8a99b069c4440939f93d7bf90cf30c140eec0df4b

  • SHA512

    4e369a68cfe44c019b19f35914b51d857a8eb33a974475b45b5604124924780f94feb0fb70ea83a1f2393d66fd24ff4e4a2e8ec5dad68d5c268873c943694b4f

  • SSDEEP

    12288:tp+rgRNyA55IxJ+feDOa9rZj5XqkJD0QrOod7XxlW91RRz9MH:tpugRNJI1D39dlfGQrFUx9MH

  Score

  10^/10

  remcoshostdiscoverypersistenceratspywarestealer

  • Remcos

    Remcos is a closed-source remote control and surveillance software.

    ratremcos

  • Remcos family

    remcos

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Adds Run key to start application

    persistence

  • Suspicious use of SetThreadContext

  behavioral1behavioral2