Extracted

• • Target
    0a9f6da50ec15864bd2f5952afb9edd17a30ef0fa2d311a53e14a40ccd845152.exe
  • Size 986KB
  • SHA256 0a9f6da50ec15864bd2f5952afb9edd17a30ef0fa2d311a53e14a40ccd845152
  • MD5 a92df2baf630f76926a12901dc0162c9
  • SHA1 c5ec73b54af3afbde64e08f58113422ee4c11e15
  • SHA512 8e4df3ad1cdcbacf09c907bcb69efa1ef4c5fd762a56b361fc29ba7cae1055431a0bcbb674eb43b1278bfc9d19f617a4ac6911c86e80db41348d695646ba31d2
  • SSDEEP 24576:f0N5O/WKY4QI3VjEBsJUFha3CjI93egym3lRI90AovitTPe11:8/eQIZGY3CU9egfU0AovitC11
  • MD5 SHA1 SHA512 SSDEEP

  Score

  10^/10

  remcosremotehostpersistenceratcollectionspywarestealer

  • Remcos

    Remcos is a closed-source remote control and surveillance software.

    ratremcos

  • Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003)

  • Detects executables built or packed with MPress PE compressor

  • Detects executables referencing many confidential data stores found in browsers, mail clients, cryptocurreny wallets, etc. Observed in information stealers

  • Detects executables referencing many email and collaboration clients. Observed in information stealers

  • NirSoft MailPassView

    Password recovery tool for various email clients

  • NirSoft WebBrowserPassView

    Password recovery tool for various web browsers

  • Nirsoft

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Accesses Microsoft Outlook accounts

    collection

  • Adds Run key to start application

    persistence

  • Suspicious use of SetThreadContext

  behavioral1behavioral2