Extracted

• • Target

    NEW ORDER FE7191PO1.exe

  • Size

    971KB

  • MD5

    b0442c4273a9316c625815156b6fbbe5

  • SHA1

    2e581d3e24a7e2e69369b259afd32dbcc0cbf20e

  • SHA256

    c1eeb9ddca80bda9fa0f220c2eb5767021a29055e8edc7b25249e65aa24123eb

  • SHA512

    c6100e66aa886239f96beade7e2e3431b26545653b8d482faacd274d31f6e8ce49488e5fa366733b6acfa1edc40dd91d8a888676556c37eceaeaf7ad185acabe

  • SSDEEP

    24576:+bYUn9Wx+3amLyuRVRc2dqJsSJ68H6pIsaHqwk53kxqfTGDk:+XQxqaoycKuqJunIsaHZk53kEl

  Score

  10^/10

  remcosremotehostdiscoveryexecutionratcollectionspywarestealer

  • Remcos

    Remcos is a closed-source remote control and surveillance software.

    ratremcos

  • Remcos family

    remcos

  • Detected Nirsoft tools

    Free utilities often used by attackers which can steal passwords, product keys, etc.

  • NirSoft MailPassView

    Password recovery tool for various email clients

  • NirSoft WebBrowserPassView

    Password recovery tool for various web browsers

  • Command and Scripting Interpreter: PowerShell

    Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

    execution

  • Downloads MZ/PE file

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Accesses Microsoft Outlook accounts

    collection

  • Suspicious use of SetThreadContext

  behavioral1behavioral2