Extracted

• • Target
    44c0276f4eb577c8914ebf18fce806ab20dec017c6dfc553b13b7c6cca0a087e
  • Size 6.9MB
  • SHA256 44c0276f4eb577c8914ebf18fce806ab20dec017c6dfc553b13b7c6cca0a087e
  • MD5 4e5d4e845d8151e1763e1778c6802d21
  • SHA1 d825fab991db7e4b146341adde684e72909f3236
  • SHA512 4d0656f6b18003416f6bfcab1c0a7664f30c4db723465f9f4f1a6f02c90dec2f794a177e422762538a93df49231d925b4a3d56c2defdac2af92a97830267f12a
  • SSDEEP 98304:6kUb1rBq5Pfr+u2ZwS0SwZFtv445NdaCT1hkNV95OTpLipdbN1BbkJ9J8OXzxHxz:6kWyKajZFt3VfT1YVX6+R4JHj+
  • MD5 SHA1 SHA512 SSDEEP

  Score

  10^/10

  remcosdlscordpersistenceratupxexecutionspywarestealer

  • Modifies WinLogon for persistence

    persistence

  • Remcos

    Remcos is a closed-source remote control and surveillance software.

    ratremcos

  • detects Windows exceutables potentially bypassing UAC using eventvwr.exe

  • Adds policy Run key to start application

    persistence

  • Command and Scripting Interpreter: PowerShell

    Using powershell.exe command.

    execution

  • Drops file in Drivers directory

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx

  • Accesses cryptocurrency files/wallets, possible credential harvesting

    spyware

  • Adds Run key to start application

    persistence

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Modifies WinLogon

    persistence

  • Drops file in System32 directory

  • Suspicious use of SetThreadContext

  behavioral1behavioral2