Extracted

• • Target
    Fiyat Teklifi ve Termin Bilgisi Rica Ederiz. SiparisNHM-0026.exe
  • Size 1.2MB
  • SHA256 2944010e5dc27c32e209f1aa2f0e9fb2ba05e90acb0beaccf16622b31389a349
  • MD5 6cd777ffe145cdd3d86dff6128013aa6
  • SHA1 6aea060064608778a6266d73a91b3f149e7baec6
  • SHA512 819081cf8df5eff0e0fbfde8a21f9269497d9bd15fa3fa09c0c0513609996d5eb5bdd7d88c15c24063ef325194b4e966fce2fd53ac82585eca5807471725eb84
  • SSDEEP 24576:NrbbXjskG0SmW+ZfYHPr3kNO5UAqa/B60rnV1tVd9oPBTvgOmNUNEbp:NrnXjsIW+ZfsPrUNVAm0xVdiJTvyNUmF
  • TLSH
    T1A25513146615D703D9D69B741AB2F2785BBC6DCAB850E3074FE8ADEFB866B050D08383
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  ughostcollectiondiscoveryexecutionremcosratspywarestealer

  • Remcos

    Remcos is a closed-source remote control and surveillance software.

    ratremcos

  • Remcos family

    remcos

  • Detected Nirsoft tools

    Free utilities often used by attackers which can steal passwords, product keys, etc.

  • NirSoft MailPassView

    Password recovery tool for various email clients

  • Command and Scripting Interpreter: PowerShell

    Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

    execution

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Drops startup file

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Accesses Microsoft Outlook accounts

    collection

  • Suspicious use of SetThreadContext

  behavioral1behavioral2