Extracted

• • Target
    RFQPSSOPEXY327JAN26049 067 072 078.exe
  • Size 1.1MB
  • SHA256 bf46723d199408eb636dfbb7d50ef97fad7c96be7aedca35fa350c92a7492a4e
  • MD5 1fcac0788a780613cb91296f5b367993
  • SHA1 35c368b8352ec4d1db5c7e88e3ac45b590d6f6e5
  • SHA512 32db557ffa15a05ee6fad5032a02dbf0c0b68db130e62aa96cdbdaf7725b83e3c2543a3c0938e4f5a0e1038f6c288024f08fca2175e91160fe980741da149184
  • SSDEEP 24576:yDCrouhwkzhhEyowgsip/CN4sVu7qoLE0YAomQL9wzUkjFqX:OC/z8wgsM/izyqoQtAoGzUkwX
  • MD5 SHA1 SHA512 SSDEEP

  Score

  10^/10

  ughostcollectiondiscoveryexecutionremcosratspywarestealer

  • Remcos

    Remcos is a closed-source remote control and surveillance software.

    ratremcos

  • Remcos family

    remcos

  • Detected Nirsoft tools

    Free utilities often used by attackers which can steal passwords, product keys, etc.

  • NirSoft MailPassView

    Password recovery tool for various email clients

  • Command and Scripting Interpreter: PowerShell

    Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

    execution

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Drops startup file

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Accesses Microsoft Outlook accounts

    collection

  • SmartAssembly .NET packer

    Detects SmartAssembly .NET packer.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2