Extracted

• • Target
    1b8bf6014500f3f82fdb14a87fdebaeb0bfe707983e4d810a1012f62ed03135c.exe
  • Size 819KB
  • SHA256 1b8bf6014500f3f82fdb14a87fdebaeb0bfe707983e4d810a1012f62ed03135c
  • MD5 80e136aa16ecad871d770474a9875924
  • SHA1 31f0a22512c8e7dc74c36590e810c3ec13744603
  • SHA512 ce5311ec635194958d1766db0c124615609d5287f505c3b52f38ecc3afbb37e098b7a44163969a650b6154d1d9434d6f019391e440634405bd7055240a547d0b
  • SSDEEP 24576:JfnYNSoeuTPZAX/LZNUgJEEEEEEEEEEEEEEEEEEEE:JMuPEEEEEEEEEEEEEEEEEEEE
  • MD5 SHA1 SHA512 SSDEEP

  Score

  10^/10

  remcosremotehostcollectionpersistenceratspywarestealer

  • Remcos

    Remcos is a closed-source remote control and surveillance software.

    ratremcos

  • Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003)

  • Detects executables built or packed with MPress PE compressor

  • Detects executables referencing many confidential data stores found in browsers, mail clients, cryptocurreny wallets, etc. Observed in information stealers

  • Detects executables referencing many email and collaboration clients. Observed in information stealers

  • NirSoft MailPassView

    Password recovery tool for various email clients

  • NirSoft WebBrowserPassView

    Password recovery tool for various web browsers

  • Nirsoft

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Accesses Microsoft Outlook accounts

    collection

  • Adds Run key to start application

    persistence

  • Suspicious use of SetThreadContext

  behavioral1behavioral2