Extracted

• • Target

    e8150f2ffbd67dbb394b4d6889693cfd50b5bfaf74825f814c3b46832d6d8851

  • Size

    1.1MB

  • MD5

    73c43f022ab0f2c487b181d2f663da1d

  • SHA1

    717f9dc672446cab2a0bbfc3c776304370ec9d23

  • SHA256

    e8150f2ffbd67dbb394b4d6889693cfd50b5bfaf74825f814c3b46832d6d8851

  • SHA512

    9894abb1aeb900ded96cb1dbf8c75d2160e1ac8a5787525c5adb4f8c39feca3897ea026752a6028e5d1a62ca3c7acae6767532eb0305b1ec812915c6d13c68ff

  • SSDEEP

    12288:Gp+rgRNyA55IxJ+feDOa9rZj5XqkJD0QrOod7XxlW91RRzwAY3Ak83R1:GpugRNJI1D39dlfGQrFUxwAeAk83R1

  Score

  10^/10

  discoveryremcoshostpersistenceratspywarestealer

  • Remcos

    Remcos is a closed-source remote control and surveillance software.

    ratremcos

  • Remcos family

    remcos

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Adds Run key to start application

    persistence

  • Suspicious use of SetThreadContext

  behavioral1behavioral2