Extracted

• • Target

    notmyfault.exe

  • Size

    299KB

  • MD5

    833d5bbdf80d17a384e9b27798ea4d6c

  • SHA1

    4ab55a97e76fd2cdb55ed305c984d87e9a06b1b1

  • SHA256

    41ddb886060471d702693cbff1e7aa73c8ada5b29d9ee313de9972ab663a100d

  • SHA512

    ae0011fd58b09f752d2c1a926b8740780798cd17b2704adb666826d8334e07208ceaac661122c8d7ac82178f3f39aee2ac2724776e96dfd3ee526d9e98a82ec8

  • SSDEEP

    6144:whvkHmbGp7MCvRDlfJHbwZCjO0fNg1iyk:whMGbGlR5Pm1i/

  Score

  10^/10

  remcoshostdefense_evasiondiscoveryevasionexecutionpersistenceratspywarestealertrojanupx

  • Remcos

    Remcos is a closed-source remote control and surveillance software.

    ratremcos

  • Remcos family

    remcos

  • UAC bypass

    evasiontrojan

  • Creates new service(s)

    persistenceexecution

  • Downloads MZ/PE file

  • Drops file in Drivers directory

  • Stops running service(s)

    evasionexecution

  • ACProtect 1.3x - 1.4x DLL software

    Detects file using ACProtect software.

  • Executes dropped EXE

  • Loads dropped DLL

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Adds Run key to start application

    persistence

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery

  • Drops desktop.ini file(s)

  • Legitimate hosting services abused for malware hosting/C2

  • Drops file in System32 directory

  • Suspicious use of SetThreadContext

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  behavioral1