Extracted

• • Target
    Abkar Elekt specs dimn_siparis 1000 Metre,H07RN-F-NHXMH.exe
  • Size 1.3MB
  • SHA256 e81a2db8cb80396874720064cdfbf62901b1e6b96e8395d6a9846bf930f7efa0
  • MD5 6439965d3d15c9ca71ca8c91d674a07f
  • SHA1 9aed2b24c656f3cc2864f2fe4a9c4df117a77fa8
  • SHA512 9ebb1fcd2aeadbda1a3e0ec4a2eea13903da6947110c75db17ee09b18484c632ea83c382bf11a13ea2e4f018c3212afb4b2e4c40bb810fc1a9b6457d968f7862
  • SSDEEP 24576:O2jKeZVZniNEkVR4mGg32mKKJedWJ4W+aZ:hKeP0O8RdGm2mKFdWCW+U
  • MD5 SHA1 SHA512 SSDEEP

  Score

  10^/10

  remahost1collectiondiscoveryexecutionremcosratspywarestealer

  • Remcos

    Remcos is a closed-source remote control and surveillance software.

    ratremcos

  • Remcos family

    remcos

  • Detected Nirsoft tools

    Free utilities often used by attackers which can steal passwords, product keys, etc.

  • NirSoft MailPassView

    Password recovery tool for various email clients

  • Command and Scripting Interpreter: PowerShell

    Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

    execution

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Drops startup file

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Accesses Microsoft Outlook accounts

    collection

  • SmartAssembly .NET packer

    Detects SmartAssembly .NET packer.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2