Extracted

• • Target

    Vendor Questionnaire and EOI.exe

  • Size

    610KB

  • MD5

    d0627ad0019378cd5a6f23eb4a0f1c8f

  • SHA1

    9626f6c80883b8203b299a1d751e136bf5e16e54

  • SHA256

    f9a75f67ab3b4e7fa308bdac0ab7a6c40f0189fb3d95cfdb455023080a89c517

  • SHA512

    8b6a2d8c71a2232f07c17d6e1e67e34945cbf08dad2426112ace21c4d808fdbf05adc44e78be742067130255af819d97cae93bf3c68f05da5c88777b6a8bbdd8

  • SSDEEP

    12288:p98UWQxHvxTMN0X4YcXGw9CIOmUwuTRQXgz3sK7hvhO7G:paQxG3YWGkCIhUwuTRQwrl9e

  Score

  10^/10

  remcosgooglegroupaccountcollectiondiscoverypersistenceratspywarestealer

  • Remcos

    Remcos is a closed-source remote control and surveillance software.

    ratremcos

  • Remcos family

    remcos

  • Detected Nirsoft tools

    Free utilities often used by attackers which can steal passwords, product keys, etc.

  • NirSoft MailPassView

    Password recovery tool for various email clients

  • NirSoft WebBrowserPassView

    Password recovery tool for various web browsers

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Accesses Microsoft Outlook accounts

    collection

  • Adds Run key to start application

    persistence

  • Suspicious use of SetThreadContext

  behavioral1behavioral2