Extracted

• • Target

    BL-TLN0124796CMACGM.scr

  • Size

    915KB

  • MD5

    02d513fa3a4c04f1ffce97c25caccdff

  • SHA1

    853948f7ff1d69a293c4f4617185c24b9859e6dd

  • SHA256

    d00a443bf00b909b32fbd9894462283fca5788e28b96a9e729f43fc4f2ca585a

  • SHA512

    9a9b925e7d5acec5216ecb64f7352a8a27598106452984f08155f2bef640fe1ad93ff3a7869cacfaec2514641740c41fcc0e7e4f0172eaa7072c1c9c05087ab3

  • SSDEEP

    24576:SgW2J4Sl29MaW6EEJJQEtTShtxMwwW7yUVzmoeli:SgjJYSoxtuDxZlyUVzmo

  Score

  10^/10

  remcosgeneralwire-slavescollectiondiscoveryexecutionratspywarestealer

  • Remcos

    Remcos is a closed-source remote control and surveillance software.

    ratremcos

  • Detected Nirsoft tools

    Free utilities often used by attackers which can steal passwords, product keys, etc.

  • NirSoft MailPassView

    Password recovery tool for various email clients

  • NirSoft WebBrowserPassView

    Password recovery tool for various web browsers

  • Command and Scripting Interpreter: PowerShell

    Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

    execution

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Accesses Microsoft Outlook accounts

    collection

  • Suspicious use of SetThreadContext

  behavioral1behavioral2