Extracted

• • Target

    5a775d8c281f0a20b40ae98a67c456c1114b5440b19efb621573f3ac2f0f6379

  • Size

    1.8MB

  • MD5

    0431be431ade102a44e8e3582c71f921

  • SHA1

    98d00d419396a3ae5c844890b4ded9431ec9357a

  • SHA256

    5a775d8c281f0a20b40ae98a67c456c1114b5440b19efb621573f3ac2f0f6379

  • SHA512

    feb2837771607dfca36f94d87988eed2212434fb7a21f54835483132aa81b82927d9b32589d42437521cb3e1fc566fce46067f4ee0f6753a65934afe4471d4a7

  • SSDEEP

    24576:6D39v74lfGQrFUspugRNJI2DJ53J/J/L5dJPjoE:6p7E+QrFUBgq2F

  Score

  10^/10

  remcoshostdiscoverypersistenceratspywarestealer

  • Remcos

    Remcos is a closed-source remote control and surveillance software.

    ratremcos

  • Remcos family

    remcos

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Adds Run key to start application

    persistence

  • Suspicious use of SetThreadContext

  behavioral1behavioral2