Extracted

• • Target

    RFQ-NO 00967-HYU001-Project Order.exe

  • Size

    1.5MB

  • MD5

    58906f0d0d57dc8b5f32a7d779cdea22

  • SHA1

    e7e0546255d9595e903a5dd641f1234979dd59ea

  • SHA256

    502adbc1e5177691e69d8a3159aae8f5672e9ccf8eadda3f6c4fccb3d258dd6d

  • SHA512

    c08dab3ddd376af6405a8816e05525bf099628a6ebb0d29f510fe463f4f47cfe5e134350749272219038c984b8a38961782637a4c96981a916130851b004fdc4

  • SSDEEP

    49152:UJT2EhlJjIw8Fhno/SWR7Zosw/19gl3cJ:OBxjIZ9oKoZho1/

  Score

  10^/10

  remcosremotehostdiscoveryexecutionratspywarestealer

  • Remcos

    Remcos is a closed-source remote control and surveillance software.

    ratremcos

  • Command and Scripting Interpreter: PowerShell

    Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

    execution

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Drops file in System32 directory

  • Suspicious use of SetThreadContext

  behavioral1behavioral2