Extracted

• • Target

    8df645995df261a5bc7c19d2ba16127256054497e498faaba582dffe10e01f91

  • Size

    986KB

  • MD5

    d5da623ad42a511796d291c516a5dbb6

  • SHA1

    029ef97714317521a472f7a8770295421a585e45

  • SHA256

    8df645995df261a5bc7c19d2ba16127256054497e498faaba582dffe10e01f91

  • SHA512

    eb64880cbe757026605f76d737f00ed73fb28b0580cab7a1f225295252fa3f366875e999e2493c4a7050769aa8989660ec140dc39231974f011e91001eb50acd

  • SSDEEP

    24576:xGQ3AgIk9qzYhJVbysG2iPQE2cjYkT0CdA0uYvr0TzP1R:gQQJk9xVboRPQLcfTZZRvwTzPn

  Score

  10^/10

  remcosremotehostcollectiondiscoveryexecutionratspywarestealer

  • Remcos

    Remcos is a closed-source remote control and surveillance software.

    ratremcos

  • Remcos family

    remcos

  • Detected Nirsoft tools

    Free utilities often used by attackers which can steal passwords, product keys, etc.

  • NirSoft MailPassView

    Password recovery tool for various email clients

  • NirSoft WebBrowserPassView

    Password recovery tool for various web browsers

  • Command and Scripting Interpreter: PowerShell

    Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

    execution

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Accesses Microsoft Outlook accounts

    collection

  • Suspicious use of SetThreadContext

  behavioral1behavioral2