Extracted

• • Target

    8b2be7e5b6f709d345242f0b8482617b7261eee534a0d099b84273c823211a79

  • Size

    1.0MB

  • MD5

    3fefcce2a73211465409608589fcf1a6

  • SHA1

    891e41f2790883189ccdcfb49cdb1b9957898341

  • SHA256

    8b2be7e5b6f709d345242f0b8482617b7261eee534a0d099b84273c823211a79

  • SHA512

    c5de9eddc921dc495c0f373ebc7488609d003271e908e1eb0b528042c9ee2e11bc6e51c81b1f24b6c0e8368bd8a21627827cd305c487d7b906c2d92f06d073ac

  • SSDEEP

    12288:/p+rgRNyA55IxJ+feDOa9rZj5XqkJD0QrOod7XxlW91RRzwAY3AkK:/pugRNJI1D39dlfGQrFUxwAeAkK

  Score

  10^/10

  discoveryremcoshostpersistenceratspywarestealer

  • Remcos

    Remcos is a closed-source remote control and surveillance software.

    ratremcos

  • Remcos family

    remcos

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Adds Run key to start application

    persistence

  • Suspicious use of SetThreadContext

  behavioral1behavioral2