Extracted

• • Target

    d99f687b6e744e9d9bdff2e59c273c85deff48dbaa52bf2d64009fd5ec4907ab.exe

  • Size

    901KB

  • MD5

    784b07833fbdca10528dbeb3eb1daffe

  • SHA1

    beee89b885546c0dc98f7931f097f9659bbb8419

  • SHA256

    d99f687b6e744e9d9bdff2e59c273c85deff48dbaa52bf2d64009fd5ec4907ab

  • SHA512

    459916b828fcef6f3eb9aa2e123078a33907281ac47aab71bb3140ce446a6694bdb6347b1dec6678a96368768697a4045bd31b9110b2d87306a011296264dc4b

  • SSDEEP

    24576:pSl++842srFVCeJ8E5WryTL/8bTAWrtCh:pSl++842srfp+EW4oAQtU

  Score

  10^/10

  remcosremotehostcollectiondiscoverypersistenceratspywarestealer

  • Remcos

    Remcos is a closed-source remote control and surveillance software.

    ratremcos

  • Detected Nirsoft tools

    Free utilities often used by attackers which can steal passwords, product keys, etc.

  • NirSoft MailPassView

    Password recovery tool for various email clients

  • NirSoft WebBrowserPassView

    Password recovery tool for various web browsers

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Accesses Microsoft Outlook accounts

    collection

  • Adds Run key to start application

    persistence

  • Suspicious use of SetThreadContext

  behavioral1behavioral2