Extracted

• • Target

    DOC927-TT823-2837_pdf.exe

  • Size

    222KB

  • MD5

    4fa3f61b3082f60f2b1be0408900bfea

  • SHA1

    4b051e7c9db390c13d1fd297518986fcfdd9f09c

  • SHA256

    d7edec42151eb4762b265be6014bd7f391c948406a46a9f997337e2b80424193

  • SHA512

    ecf6623e7e9a20f08cf3ae2f8da5e51b6047fe5613c2ef7c99db7d98e8bb3d6cf51c81475db194e3d380c69b64bb2197fe343914f766068a5439729e69a1a218

  Score

  10^/10

  spywareratremcos

  • Remcos

    Remcos is a closed-source remote control and surveillance software.

    ratremcos

  • Looks for VirtualBox Guest Additions in registry

  • Looks for VMWare Tools registry key

  • Checks BIOS information in registry

    BIOS information is often read in order to detect sandboxing environments.

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spyware

  • Maps connected drives based on registry

    Disk information is often read in order to detect sandboxing environments.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2