Extracted

• • Target

    ae5f2c9942b61b2f7282dd970e410f373e8cf50429c19dc7da38080513b5c372

  • Size

    372KB

  • MD5

    19937ad01f3fc2fe28941feb4c110ee8

  • SHA1

    46376eb5c9f27d82a7a43d7eca08553b18d72e60

  • SHA256

    ae5f2c9942b61b2f7282dd970e410f373e8cf50429c19dc7da38080513b5c372

  • SHA512

    d547496f9f7e520f3b558fc0e918ebe1ee384084aa4d9c849c28fc097697017ce4753d1a1a2957d4f99511ab90415f9b0017931267cc82120aa46151355ba782

  • SSDEEP

    6144:tqdgUkQx+HXGidCzj8LBb8Rw5Jdypyf6aCXYfhiKu:tAqQx+H2i+8LBNbdypazCXY8

  Score

  10^/10

  discoveryremcostinopersistencerat

  • Modifies WinLogon for persistence

    persistence

  • Remcos

    Remcos is a closed-source remote control and surveillance software.

    ratremcos

  • Remcos family

    remcos

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Adds Run key to start application

    persistence

  • Modifies WinLogon

    persistence

  • Suspicious use of SetThreadContext

  behavioral1behavioral2