Extracted

• • Target

    remcos_a.exe

  • Size

    469KB

  • MD5

    48f4a8f633bf5535811c23a81d8d8506

  • SHA1

    c2a98525bfda82421cb8670db223b19acef31f23

  • SHA256

    9ec9c4c81c67d6628d141981a7020bb7ded83b4c40ff693870cd98eaebf74912

  • SHA512

    7903c322d886bcffc06a9310ba451b0f0eac53d2acedf45b544548ae3656ef477b5a03a86d54452d65461957df4c643082338119bdeb0f2303f528daf0642e29

  • SSDEEP

    12288:Wmnk7iLJbpIpiRL6I2WhSKQ9ZsfZQSOn9:uiLJbpI7I2WhQqZ7O9

  Score

  10^/10

  hawkeyeremcosremotehostcollectioncredential_accessdiscoveryevasionkeyloggerpersistenceratspywarestealertrojan

  • HawkEye

    HawkEye is a malware kit that has seen continuous development since at least 2013.

    keyloggertrojanstealerspywarehawkeye

  • Remcos

    Remcos is a closed-source remote control and surveillance software.

    ratremcos

  • UAC bypass

    evasiontrojan

  • Credentials from Password Stores: Credentials from Web Browsers

    Malicious Access or copy of Web Browser Credential store.

    credential_accessstealer

  • Adds policy Run key to start application

    persistence

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Deletes itself

  • Executes dropped EXE

  • Accesses Microsoft Outlook accounts

    collection

  • Adds Run key to start application

    persistence

  • Drops file in System32 directory

  • Suspicious use of SetThreadContext

  behavioral1