Extracted

• • Target

    c9fab624be92feff5e6666dc84c8b1a1fa23d4535f0960806defa8b30817e133

  • Size

    140KB

  • MD5

    34842ed9c54bd4205d1aa40ebc118310

  • SHA1

    4cf7b739e561beb0f661fccd25ccc2c28a988410

  • SHA256

    c9fab624be92feff5e6666dc84c8b1a1fa23d4535f0960806defa8b30817e133

  • SHA512

    8baafb898697206325f1ae05bda968b2566cfce4366cba51831e55a2f01465bf26aa710e7d4242794e3a52e3e86b47389c78a3e0473086a0571f6323f4896b31

  • SSDEEP

    3072:xPd4n/M+WLcilrpgGH/GwY87mVmIXhIHVSdC:xP6/M+WLckOBhVmIYmC

  Score

  10^/10

  remcoshostdiscoverypersistencerat

  • Remcos

    Remcos is a closed-source remote control and surveillance software.

    ratremcos

  • Remcos family

    remcos

  • Boot or Logon Autostart Execution: Active Setup

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

    persistence

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Adds Run key to start application

    persistence

  • Suspicious use of SetThreadContext

  behavioral1behavioral2