Extracted

• • Target

    FACF9877656789000.bat.exe

  • Size

    1.2MB

  • MD5

    4e6fb77e41ce6e4e8ddec2a04c51b135

  • SHA1

    3f3c04d941792d7598bc6e1fb1814c44ca3d1cf4

  • SHA256

    958e5d7947f48f2047ac3c595ee724a916c9969430731091ac1b9fcfaaf65d70

  • SHA512

    0835f76379fc423c5e194bc8e852492bd68bf7b885f14e07d1dd1878d16d9a1a91153e47d484bc58cecca106547444b87587dfa8d6897acfa10f0efe5b08d619

  • SSDEEP

    24576:tthEVaPqLopaxpymFCZqtRGGAsL4+ktZuStEJz992or8rekadSfU84w:VEVUcI0pyrwtRGGA6mgStLo8uEf

  Score

  10^/10

  remcosremotehostcollectiondiscoveryratupx

  • Remcos

    Remcos is a closed-source remote control and surveillance software.

    ratremcos

  • Remcos family

    remcos

  • Detected Nirsoft tools

    Free utilities often used by attackers which can steal passwords, product keys, etc.

  • NirSoft MailPassView

    Password recovery tool for various email clients

  • NirSoft WebBrowserPassView

    Password recovery tool for various web browsers

  • Drops startup file

  • Executes dropped EXE

  • Loads dropped DLL

  • Accesses Microsoft Outlook accounts

    collection

  • AutoIT Executable

    AutoIT scripts compiled to PE executables.

  • Suspicious use of SetThreadContext

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  behavioral1behavioral2