Extracted

• • Target

    6e2e6d5f67b4bd2df522de36e957e5d0b3f97eb8b3a6a5460cc3aa32cf112cdc.exe

  • Size

    3.5MB

  • MD5

    7b9e3156025bcfaad0f0f61777fed384

  • SHA1

    2b025c4502f2b08485d9ee8b223455f31c7d3735

  • SHA256

    6e2e6d5f67b4bd2df522de36e957e5d0b3f97eb8b3a6a5460cc3aa32cf112cdc

  • SHA512

    be32a02a3417efcd08327e20524970d1bcb7deeaf0ccb8f7382185ac33734a7c70274bd766c44ade77f4b7eaa65ad8ad015e4d6ced69a39f9143bdf7a55c5b38

  • SSDEEP

    24576:1PdHrM3P9qf8Ww0wqHgbmsTVp7w/9+xXvR38apwpymoha9t:1PtrMf9qOqH9sBpaAxXpMuw4fh0

  Score

  10^/10

  remcosremotehostdiscoveryevasionexecutionrattrojancollection

  • Remcos

    Remcos is a closed-source remote control and surveillance software.

    ratremcos

  • Remcos family

    remcos

  • UAC bypass

    evasiontrojan

  • Windows security bypass

    evasiontrojan

  • Detected Nirsoft tools

    Free utilities often used by attackers which can steal passwords, product keys, etc.

  • NirSoft MailPassView

    Password recovery tool for various email clients

  • NirSoft WebBrowserPassView

    Password recovery tool for various web browsers

  • Command and Scripting Interpreter: PowerShell

    Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

    execution

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Uses the VBS compiler for execution

  • Windows security modification

    evasiontrojan

  • Accesses Microsoft Outlook accounts

    collection

  • Checks whether UAC is enabled

    evasiontrojan

  • Suspicious use of SetThreadContext

  behavioral1behavioral2