Extracted

• • Target

    SwiftCopy_PaymtRecpt121228.exe

  • Size

    1.1MB

  • MD5

    1f0ae2753f131f73c2fe881c1c8e7c8f

  • SHA1

    e3d9f0de991f7b91c04449a0a12cb398df6cbd21

  • SHA256

    695e10634e8981a0d110a120bade28b66b58c6400879b37257894d219c55048d

  • SHA512

    c300b4a521e90fbb4fddce0e11113230afc9c383be47e7e0a1fc13aa3178703fbf0ca37a6633fde98a681bfbb7a4f1603f851ed6750e315b1cdad1706631285f

  • SSDEEP

    24576:CHoI9FW8oqKqzDHgz2XmSkZVgZ9g/oPd+p:CHL0q/D22kZVa9gAPsp

  Score

  10^/10

  remcosremotehostcollectiondiscoveryexecutionratspywarestealer

  • Remcos

    Remcos is a closed-source remote control and surveillance software.

    ratremcos

  • Remcos family

    remcos

  • Detected Nirsoft tools

    Free utilities often used by attackers which can steal passwords, product keys, etc.

  • NirSoft MailPassView

    Password recovery tool for various email clients

  • NirSoft WebBrowserPassView

    Password recovery tool for various web browsers

  • Command and Scripting Interpreter: PowerShell

    Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

    execution

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Accesses Microsoft Outlook accounts

    collection

  • Suspicious use of SetThreadContext

  behavioral1behavioral2