Extracted

Extracted

• • Target

    bf73327d47da7f3a5ce4393c2075f6e596f0f57cbd71dc02e636f5a3e69dd77c

  • Size

    2.9MB

  • MD5

    2dfc49b6a16ea73550eb364cd4061ac4

  • SHA1

    25ca5ab0f53b5a61d1e59df694f8351f9aef4efa

  • SHA256

    bf73327d47da7f3a5ce4393c2075f6e596f0f57cbd71dc02e636f5a3e69dd77c

  • SHA512

    47cb010bd0ab31c28aa834a7f517bacdc1ec7693076a458f210fc840208c509b01438636718ec924660c91847203cbceb4a9ba9bdca12f16b429d27ec432c773

  • SSDEEP

    49152:hh+ZkldoPK8Yad7cwj644Mh+ZkldoPK8YaLDNct:C2cPK8YwjE2cPK8c

  Score

  10^/10

  remcosremotehostdiscoverylinkpdfpersistenceratwebmonitorbackdoorinfostealerupx

  • Remcos

    Remcos is a closed-source remote control and surveillance software.

    ratremcos

  • Remcos family

    remcos

  • RevcodeRat, WebMonitorRat

    WebMonitor is a remote access tool that you can use from any browser access to control, and monitor your phones, or PCs.

    backdoorratinfostealerwebmonitor

  • WebMonitor payload

  • Webmonitor family

    webmonitor

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Unexpected DNS network traffic destination

    Network traffic to other servers than the configured DNS servers was detected on the DNS port.

  • Adds Run key to start application

    persistence

  • AutoIT Executable

    AutoIT scripts compiled to PE executables.

  • Suspicious use of SetThreadContext

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  behavioral1behavioral2