Extracted

• • Target
    2026-06-27_c0e4c076a5828aaba0a47c0dd1adb81e_coinminer_elex_luca-stealer_mespinoza_njrat_remcos
  • Size 469KB
  • SHA256 06325408771308f50fcfa5eb6fc8ecbe5e08170c4f5908d23d9b67b30cfc0e3f
  • MD5 c0e4c076a5828aaba0a47c0dd1adb81e
  • SHA1 11f64d0f63dccd81aa3109ce6794e9569240e7e7
  • SHA512 06b7cadcd204303d9e873bcffd3e9d7d081a8c5b441cc3b2f57a9b9cb4118de4fe86932081c802e2db9e07a6f18990816c7a5b975ba9db177c4872f0aad41eb8
  • SSDEEP 12288:umnk7iLJbpIpiRL6I2WhSKQ9ZsfZQSHn9:WiLJbpI7I2WhQqZ7H9
  • TLSH
    T1A0A4AE02BAD2C072D57161344D2AE735DABDBC212835997BB3E61D5BFD30180A73A7B2
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  remotehostcollectiondiscoveryremcospersistenceratspywarestealer

  • Family: Remcos

    Remcos is a closed-source remote control and surveillance software.

    ratremcos

  • Detected Nirsoft tools

    Free utilities often used by attackers which can steal passwords, product keys, etc.

  • Detects executables built or packed with MPress PE compressor

  • Detects executables referencing many confidential data stores found in browsers, mail clients, crypt

  • Detects executables referencing many email and collaboration clients. Observed in information steale

  • NirSoft MailPassView

    Password recovery tool for various email clients

  • NirSoft WebBrowserPassView

    Password recovery tool for various web browsers

  • detects Windows exceutables potentially bypassing UAC using eventvwr.exe

  • Adds policy Run key to start application

    persistence

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Deletes itself

  • Executes dropped EXE

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Accesses Microsoft Outlook accounts

    collection

  • Accesses Microsoft Outlook profiles

    collection

  • Adds Run key to start application

    persistence

  • Suspicious use of SetThreadContext

  behavioral1behavioral2