Extracted

• • Target

    49f04d381800566903c6ae06e20482e4ef7e0b127c112389af5a3717325e7cd7

  • Size

    1.9MB

  • MD5

    24ccfe6f230a958a95303e9192616fd8

  • SHA1

    17268748c689d54969ee4d1b643c84fc1f5efd50

  • SHA256

    49f04d381800566903c6ae06e20482e4ef7e0b127c112389af5a3717325e7cd7

  • SHA512

    c8d3b4cc7cac9b20d2cd998542c4a69c83ccfea989db4f2c0cec9e503c8d2cfb5ba79b6116a26044e07817769d5d1be03a593d9fb9d85f48271ca67851710171

  • SSDEEP

    24576:7D39dlfGQrFUspugRNJI2DJnUw9W/j+BeKJWqwH6jI:7F+QrFUBgq25eKu6jI

  Score

  10^/10

  remcoshostdiscoverypersistenceratspywarestealer

  • Remcos

    Remcos is a closed-source remote control and surveillance software.

    ratremcos

  • Remcos family

    remcos

  • Boot or Logon Autostart Execution: Active Setup

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

    persistence

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Adds Run key to start application

    persistence

  • Suspicious use of SetThreadContext

  behavioral1behavioral2