Extracted

• • Target

    cc25c37834e04127c13349d5a8639e15163ee72e9a156efb06f06baccb524124

  • Size

    1.9MB

  • MD5

    a1fa1f1fb1412e7de0e3bef87343290d

  • SHA1

    7bc05b344cb418027ad279c036a9182e4e5d7350

  • SHA256

    cc25c37834e04127c13349d5a8639e15163ee72e9a156efb06f06baccb524124

  • SHA512

    1f1a8cc9763639482fefc1ec6b61d939426e699dbe7a2b621c2eebc880b420c10b25e0c27378096146ae2cc1dbe0fdb9e7a9ed0b6d3f2929d05c24147a81124a

  • SSDEEP

    24576:MD39dlfGQrFUspugRNJI2DJnUw9W/j+BeKJWqwH6y1:MF+QrFUBgq25eKu6y1

  Score

  10^/10

  remcoshostdiscoverypersistenceratspywarestealer

  • Remcos

    Remcos is a closed-source remote control and surveillance software.

    ratremcos

  • Remcos family

    remcos

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Adds Run key to start application

    persistence

  • Suspicious use of SetThreadContext

  behavioral1behavioral2