Extracted

• • Target

    Draft - HBL# WSPAE1311198 VSL# COSCO NETHERLANDS V-067E.scr.exe

  • Size

    1.1MB

  • MD5

    bc74e2d086d7bef42c3604c1dafc3edb

  • SHA1

    f3ba507bee10af7e9fd64b1c70fecb975e216073

  • SHA256

    b2a1e0e508be9c7546a8af45c72f2032f067ac036f03ec0c8309b368b195a65c

  • SHA512

    0844fb41b40e29c363b7c62f39819569f405f6c038bc904afe1d2296ec08f3f339aef3f5e132b81be25819a3c90013b86af64e6737126175d8de88ec1cfd972f

  • SSDEEP

    24576:V2xjyUVJKPWlHhWp19hnxRpPNX7HLQUqckP9LbuLCnYng:IUUVJVlHkpVnx3d7HLpEVLtnY

  Score

  10^/10

  remcosremotehostcollectiondiscoverypersistenceratspywarestealer

  • Remcos

    Remcos is a closed-source remote control and surveillance software.

    ratremcos

  • Remcos family

    remcos

  • Detected Nirsoft tools

    Free utilities often used by attackers which can steal passwords, product keys, etc.

  • NirSoft MailPassView

    Password recovery tool for various email clients

  • NirSoft WebBrowserPassView

    Password recovery tool for various web browsers

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Accesses Microsoft Outlook accounts

    collection

  • Adds Run key to start application

    persistence

  • Suspicious use of SetThreadContext

  behavioral1behavioral2