Extracted

• • Target
    Payment Advice-BCS_ECS9522024072517150011_4137_952.PDF.exe
  • Size 1.2MB
  • SHA256 f67f5bb3bd7ee0cdf4f4420f71bb13852f4f69687e8aba379cf45687fdda0bf7
  • MD5 187869fef986ba0a771d0161712e8efd
  • SHA1 5df907792f2792532639044db562aa06e52fd60b
  • SHA512 1f1c32a1fe06026e6f7cba765052a87e5cc7a76fc8b0f2e5d2c751513bed80a5ab16de1b20c77ce699647c97f1d693bf9fbfd06a60e124c672b19d7a99c90649
  • SSDEEP 24576:YwTvpI1Zmua1fqbW3Du55sj/n++JXfdVw4AyTlHy:14ZUfGW3v++JXfdVw4AmlS
  • MD5 SHA1 SHA512 SSDEEP

  Score

  10^/10

  remcosremotehostcollectioncredential_accessdiscoveryevasionexecutionratstealertrojan

  • Remcos

    Remcos is a closed-source remote control and surveillance software.

    ratremcos

  • UAC bypass

    evasiontrojan

  • Windows security bypass

    evasiontrojan

  • Credentials from Password Stores: Credentials from Web Browsers

    Malicious Access or copy of Web Browser Credential store.

    credential_accessstealer

  • Detected Nirsoft tools

    Free utilities often used by attackers which can steal passwords, product keys, etc.

  • NirSoft MailPassView

    Password recovery tool for various email clients

  • NirSoft WebBrowserPassView

    Password recovery tool for various web browsers

  • Command and Scripting Interpreter: PowerShell

    Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

    execution

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Windows security modification

    evasiontrojan

  • Accesses Microsoft Outlook accounts

    collection

  • Checks whether UAC is enabled

    evasiontrojan

  • Suspicious use of SetThreadContext

  behavioral1behavioral2