Extracted

• • Target

    3B84DCE82113710E5AE3F379EBD9FA13.exe

  • Size

    1.1MB

  • MD5

    3b84dce82113710e5ae3f379ebd9fa13

  • SHA1

    26df2f5f9ba223ce4848586582172c9c20516416

  • SHA256

    b25e19cd5dc45047c4ad68fbe940dd1f923800201666adf9164ec5fe5d74f6e4

  • SHA512

    299ed1e965189ff3d25bd6e12790d93648c0d69959eeab8d5d7c4563c3488764eadf968855782d50d68c98d67a6a63be80828367ec704a102c407ebd7a2fa871

  • SSDEEP

    24576:wHeZDOyc0wCqMXY1nhtFUSU6xNP1cQYY:wHbLm4ftFzx7c

  Score

  10^/10

  discoveryexecutionremcosremotehostcollectionratspywarestealer

  • Remcos

    Remcos is a closed-source remote control and surveillance software.

    ratremcos

  • Remcos family

    remcos

  • Detected Nirsoft tools

    Free utilities often used by attackers which can steal passwords, product keys, etc.

  • NirSoft MailPassView

    Password recovery tool for various email clients

  • NirSoft WebBrowserPassView

    Password recovery tool for various web browsers

  • Command and Scripting Interpreter: PowerShell

    Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

    execution

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Accesses Microsoft Outlook accounts

    collection

  • Suspicious use of SetThreadContext

  behavioral1behavioral2