Extracted

• • Target

    ShippingDocs.exe

  • Size

    55KB

  • MD5

    a3e458f7e2e1f940b0c62042afe607d3

  • SHA1

    6fb0a031365530ebb273f47f034181a530e31b70

  • SHA256

    1730338ca0fbfe0985bed5638fc8599a6dd38761ab8b89e3d8a076947a320028

  • SHA512

    9d27b5a6e1086b315bb71cccca1f64e718d1815adbccde1a3483e1404ec3d5d8a6eddc90de373e362543a8db69bf5118e36fef6c8b4cc82d40a4f771b44766e8

  Score

  10^/10

  remcosremusd31kdiscoverypersistenceratspywarestealer

  • Modifies WinLogon for persistence

    persistence

  • Remcos

    Remcos is a closed-source remote control and surveillance software.

    ratremcos

  • Executes dropped EXE

  • Patched UPX-packed file

    Sample is packed with UPX but required header fields are zeroed out to prevent unpacking with the default UPX tool.

  • Loads dropped DLL

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery

  • Suspicious use of SetThreadContext

  behavioral1behavioral2