Extracted

• • Target
    Scan0004.exe
  • Size 1.5MB
  • SHA256 bb9a5f5fe0d086e592ea23909cb1aa8baf792990c90691016da16908d01e83a4
  • MD5 94e7502ee1d0fb12fa17acaa5588edb5
  • SHA1 8591a11d052e3f71a45c6a35aabd51f53e3d6358
  • SHA512 4af2ed9f384b35dbb86230ba7358ad27e6bb4064759f9a6c1960c01b23e6b75e4c43bba06e5535a14a2a0e0e953bd7a560b480cbf5eb264a5d8c2ecdcfb42899
  • SSDEEP 49152:6nZgFptlqOoJ6BKKTzLfiJleynlWzJBAdS0EQtfOC:Aa/N4KTKJleKIBAdSMtfOC
  • TLSH
    T13675F1A87215BD4FC4B38877896AED7489685DA6C317D31744E33DEFB43D68A8E010A3
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  newminercollectiondiscoveryevasionexecutionremcospersistenceratspywarestealertrojan

  • Family: Remcos

    Remcos is a closed-source remote control and surveillance software.

    ratremcos

  • Modifies Windows Defender DisableAntiSpyware settings

    evasiontrojan

  • Command and Scripting Interpreter: PowerShell

    Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

    execution

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Accesses Microsoft Outlook profiles

    collection

  • Adds Run key to start application

    persistence

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery

  • Suspicious use of SetThreadContext

  behavioral1behavioral2