Extracted

• • Target

    8864b508e11703efd0dfec01cf7e5b1f1f53bab99eb66ca8c4ee3884acb8f5a2.exe

  • Size

    482KB

  • MD5

    72351686e502b31b3649f3b0b8f84331

  • SHA1

    50a3f1220ccd0b7cea5e3333c5aa59d4ecd7681f

  • SHA256

    8864b508e11703efd0dfec01cf7e5b1f1f53bab99eb66ca8c4ee3884acb8f5a2

  • SHA512

    e5268e9593fc84727749bab82380a2a9e845463bea1c577af9a688e067e8f4aba6fce4fb02c79229570c0bbb77e293e3682065436b97c327104d66888037ab3c

  • SSDEEP

    12288:913ak/mBXTG4/1v08KI7ZnMEF76JqmsvZQNS:Xak/mBXTV/R0nEF76gFZ2

  Score

  10^/10

  collectiondiscoveryspywarestealerremcosremotehostadwarepersistenceprivilege_escalationrat

  • Remcos

    Remcos is a closed-source remote control and surveillance software.

    ratremcos

  • Remcos family

    remcos

  • Detected Nirsoft tools

    Free utilities often used by attackers which can steal passwords, product keys, etc.

  • NirSoft MailPassView

    Password recovery tool for various email clients

  • NirSoft WebBrowserPassView

    Password recovery tool for various web browsers

  • Boot or Logon Autostart Execution: Active Setup

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

    persistence

  • Downloads MZ/PE file

  • Event Triggered Execution: Component Object Model Hijacking

    Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.

    persistenceprivilege_escalation

  • Executes dropped EXE

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Accesses Microsoft Outlook accounts

    collection

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery

  • Installs/modifies Browser Helper Object

    BHOs are DLL modules which act as plugins for Internet Explorer.

    stealeradware

  • Drops file in System32 directory

  • Suspicious use of SetThreadContext

  behavioral1behavioral2