Extracted

• • Target

    dfa64dc7ba3712eec6272c7284549f3f5f7f280eb45f33f2d943e189e7cdd056.exe

  • Size

    1005KB

  • MD5

    362f334df96de91f3bc1804514111a11

  • SHA1

    b6cb9298287887ba02b99fe16da4f4956ce29658

  • SHA256

    dfa64dc7ba3712eec6272c7284549f3f5f7f280eb45f33f2d943e189e7cdd056

  • SHA512

    18c279c8dc1a7f05f71cba73427a0bf240a9f5dad63b636fbac8a02aef88685ff1d51bf3f349320277a421a3537068488068582c1e5d2b60f3f9b99353a18918

  • SSDEEP

    24576:Tdnt4t3pfCejOh92+K0n3oFDQMibhNU08FDUvS:T0nj6l73olShSFDUa

  Score

  10^/10

  remcosezemuo 2024collectionevasionexecutionrattrojan

  • Remcos

    Remcos is a closed-source remote control and surveillance software.

    ratremcos

  • UAC bypass

    evasiontrojan

  • Windows security bypass

    evasiontrojan

  • Looks for VirtualBox Guest Additions in registry

    evasion

  • NirSoft MailPassView

    Password recovery tool for various email clients

  • NirSoft WebBrowserPassView

    Password recovery tool for various web browsers

  • Nirsoft

  • Command and Scripting Interpreter: PowerShell

    Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

    execution

  • Looks for VMWare Tools registry key

    evasion

  • Checks BIOS information in registry

    BIOS information is often read in order to detect sandboxing environments.

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Uses the VBS compiler for execution

  • Windows security modification

    evasiontrojan

  • Accesses Microsoft Outlook accounts

    collection

  • Checks whether UAC is enabled

    evasiontrojan

  • Maps connected drives based on registry

    Disk information is often read in order to detect sandboxing environments.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2