Extracted

• • Target

    6e0beb7345baecae6f77fcfc0f4dfb6093ec4de7e9ee161289ee7bef7a937d83

  • Size

    372KB

  • MD5

    77f71596ddb1fa8498e660939e4ce909

  • SHA1

    b649888561e4243ff55d086c3091a323a7f29ec6

  • SHA256

    6e0beb7345baecae6f77fcfc0f4dfb6093ec4de7e9ee161289ee7bef7a937d83

  • SHA512

    cecfbb5faf3637967231959e4e941d136d2ee0c4d277758bee76d3f79ad88a2b55888ae06a4a0947b0fc7cc80c179332ff03ad1f31b49982132bb6c199fe0478

  • SSDEEP

    6144:t5dgUkQx+HXGidCzj8LBb8Rw5Jdypyf6aCXYfhiee:tbqQx+H2i+8LBNbdypazCXYY

  Score

  10^/10

  discoveryremcostinopersistencerat

  • Modifies WinLogon for persistence

    persistence

  • Remcos

    Remcos is a closed-source remote control and surveillance software.

    ratremcos

  • Remcos family

    remcos

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Adds Run key to start application

    persistence

  • Modifies WinLogon

    persistence

  • Suspicious use of SetThreadContext

  behavioral1behavioral2