Extracted

• • Target
    AQW.exe
  • Size 1.9MB
  • SHA256 c14895a7d0ca2633b565af7c08e77aef32397f4fdc78fd3560d2f23d89aa6d6a
  • MD5 3a6ac6822e16f878b966cac3365e12a0
  • SHA1 b6a15422e7c771b6b5c2177c2ff5584d7028aaf3
  • SHA512 b4572a7abc8e410e7d377a1ce8915df636d1bf9de6c0fac2889651743a4ea522f58dc4fb3ed0ba15e13396e41f3bc7eb2143e8699589f376463a1c105ee840fe
  • MD5 SHA1 SHA512

  Score

  10^/10

  remcospersistenceratspyware

  • Remcos

    Remcos is a closed-source remote control and surveillance software.

    ratremcos

  • ServiceHost packer

    Detects ServiceHost packer used for .NET malware

  • Executes dropped EXE

  • Loads dropped DLL

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spyware

  • Adds Run key to start application

    persistence

  • Suspicious use of NtSetInformationThreadHideFromDebugger

  • Suspicious use of SetThreadContext

  behavioral1behavioral2