Extracted

• • Target
    PO1145_RFID020206
  • Size 77KB
  • SHA256 238635963962671f767f1dff687e6a11222fd1ee296bb26d758a9056d10c3a1b
  • MD5 aba566a73134a15b694bc9bfd46990e8
  • SHA1 3db8b05953ee62c502d8861925227b17f4275b22
  • SHA512 12009258ea4a0b9d72367bb320842ba79b39cdc7e7aa040c6fad1c9cb78e1eef2e76332b38a239d7a5d0ff6fc0efe5a09ed215f42e1b3d6de3c693a5ff65d7bd
  • SSDEEP 1536:v/mDyx3XP70bA27qA2JmB7WHYEYEp15Ri:vE8jMA27qAOmB7W4XEpvs
  • TLSH
    T13E73A3709D450B974D4737FB9C0C565A866FE10F013308A1BDAC3F183E065DAAEA9AF9
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  cee-tyla-06collectiondiscoveryremcospersistenceprivilege_escalationrat

  • Remcos

    Remcos is a closed-source remote control and surveillance software.

    ratremcos

  • Remcos family

    remcos

  • Detected Nirsoft tools

    Free utilities often used by attackers which can steal passwords, product keys, etc.

  • NirSoft MailPassView

    Password recovery tool for various email clients

  • Badlisted process makes network request

    Network request originating from process or tool commonly abused by malware.

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Use of msiexec (install) with remote resource

  • Accesses Microsoft Outlook accounts

    collection

  • Adds Run key to start application

    persistence

  • Suspicious use of NtCreateThreadExHideFromDebugger

  • Suspicious use of NtSetInformationThreadHideFromDebugger

  • Suspicious use of SetThreadContext

  behavioral1behavioral2