Extracted

• • Target

    2592367f9cc1b37d0735e475bbb52cb61c69c0674c908b9c1d12635163cb4ffb

  • Size

    1.9MB

  • MD5

    763f1e6fe1bff405f9e6c832dc958c91

  • SHA1

    3ca2538ae35c2c17c2b1097faf2b5e1e5128279f

  • SHA256

    2592367f9cc1b37d0735e475bbb52cb61c69c0674c908b9c1d12635163cb4ffb

  • SHA512

    8146245c3953600b1875675ff7c1164201c03ac0189eb152c2cd8bc9664fa08798fec1f5a8ea42448cf1db3d0631449c1b3c3396f7267a2b10e9748efed5bed5

  • SSDEEP

    24576:QD39dlfGQrFUspugRNJI2DJnUw9W/j+BeKJWqwH6d:QF+QrFUBgq25eKu6d

  Score

  10^/10

  remcoshostdiscoverypersistenceratspywarestealer

  • Remcos

    Remcos is a closed-source remote control and surveillance software.

    ratremcos

  • Remcos family

    remcos

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Adds Run key to start application

    persistence

  • Suspicious use of SetThreadContext

  behavioral1behavioral2