Extracted

• • Target

    d1c0a9525bf259465de304408570586693062d18f7d59ec854dbc8158acb700b.exe

  • Size

    903KB

  • MD5

    2649d9e9fcbb3e96aa04e73939597ebe

  • SHA1

    7a502353814d8323752779626cdd42651c2cfc57

  • SHA256

    d1c0a9525bf259465de304408570586693062d18f7d59ec854dbc8158acb700b

  • SHA512

    11ba1a27ab7e7a6ec5638b62761d4e742f2b6c4377792952ea764dc18dc6232e8f5ba8e5bb6c9ca07deeb7eb5053a67cb4a34cee1e128c651a30f6753f2bcb4d

  • SSDEEP

    12288:tp+rgRNyA55IxJ+feDOa9rZj5XqkJD0QrOod7XxlW91RRz9Mt:tpugRNJI1D39dlfGQrFUx9Mt

  Score

  10^/10

  remcoshostdiscoverypersistenceratspywarestealer

  • Remcos

    Remcos is a closed-source remote control and surveillance software.

    ratremcos

  • Remcos family

    remcos

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Adds Run key to start application

    persistence

  • Suspicious use of SetThreadContext

  behavioral1behavioral2