Extracted

• • Target

    0fead1eec703dc70cd1eea9e557876b3525d9292ff97b46edfe0720e6856fc41.exe

  • Size

    874KB

  • MD5

    c3191e226fa56eaf0f574ec73c328469

  • SHA1

    64ee9eb2f3953cb62b0b98b13c375fbee1892d93

  • SHA256

    0fead1eec703dc70cd1eea9e557876b3525d9292ff97b46edfe0720e6856fc41

  • SHA512

    18301ba0043ec222a8c6907c275d8d811be8b2234ead812706a680a6c1431f738527db53c0893942135295bf8ed23bf64f73bd2aefb4667d220ddbc318a2ca39

  • SSDEEP

    24576:LeFmt+PTimCz4DbeYuZYqSGzLhImOOlcWd6OVyE7yn4Rt:LmM+PmmCz4Dyr4GRZJlcWcu57n

  Score

  10^/10

  remcosdhlcollectionevasionrattrojan

  • Remcos

    Remcos is a closed-source remote control and surveillance software.

    ratremcos

  • UAC bypass

    evasiontrojan

  • Windows security bypass

    evasiontrojan

  • Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003)

  • Detects executables built or packed with MPress PE compressor

  • Detects executables packed with or use KoiVM

  • Detects executables referencing many confidential data stores found in browsers, mail clients, cryptocurreny wallets, etc. Observed in information stealers

  • Detects executables referencing many email and collaboration clients. Observed in information stealers

  • NirSoft MailPassView

    Password recovery tool for various email clients

  • NirSoft WebBrowserPassView

    Password recovery tool for various web browsers

  • Nirsoft

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Windows security modification

    evasiontrojan

  • Accesses Microsoft Outlook accounts

    collection

  • Checks whether UAC is enabled

    evasiontrojan

  • Suspicious use of SetThreadContext

  behavioral1behavioral2