Extracted

• • Target
    51e21ba467683d83fa2d9856dba5c40375b05d6b5627c7c37f8024af959e235f.exe
  • Size 298KB
  • SHA256 51e21ba467683d83fa2d9856dba5c40375b05d6b5627c7c37f8024af959e235f
  • MD5 c0c0dedfb87d4c312363a9cd0259a128
  • SHA1 d83c9b52e96203f4f976ab2762a023d3b0bf141c
  • SHA512 717bd664a5465edde1b4ee771966157ee4db94be9e6b8be889263dee3a8005c6a671460223a5d5c970e9522b2ddf6a0b15ad6cceecf6160b7cbf792a0ca471ae
  • SSDEEP 6144:I5OhgOWGGYoXGEJE17bKiGJotXLeH14Xk1IAMRER43QtYm26Ndj:fhgOc92AE17HtEAQtYm2Odj
  • TLSH
    T16854120437D8E0B3C92352715A3BCB5F1FA2A9006A98534FA7504F9BBD73541CE6E6B2
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  2026collectiondiscoveryremcosinstallerpersistenceratspywarestealer

  • Family: Remcos

    Remcos is a closed-source remote control and surveillance software.

    ratremcos

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Deletes itself

  • Executes dropped EXE

  • Loads dropped DLL

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Accesses Microsoft Outlook profiles

    collection

  • Adds Run key to start application

    persistence

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery

  • Suspicious use of NtCreateThreadExHideFromDebugger

  • Suspicious use of NtSetInformationThreadHideFromDebugger

  • Suspicious use of SetThreadContext

  behavioral1behavioral2
• • Target
    $PLUGINSDIR/System.dll
  • Size 11KB
  • SHA256 a1390a78533c47e55cc364e97af431117126d04a7faed49390210ea3e89dd0e1
  • MD5 fbe295e5a1acfbd0a6271898f885fe6a
  • SHA1 d6d205922e61635472efb13c2bb92c9ac6cb96da
  • SHA512 2cb596971e504eaf1ce8e3f09719ebfb3f6234cea5ca7b0d33ec7500832ff4b97ec2bbe15a1fbf7e6a5b02c59db824092b9562cd8991f4d027feab6fd3177b06
  • SSDEEP 192:yPtkiQJr7V9r3Ftr87NfwXQ6whlgi62V7i77blbTc4DI:N7Vxr8IgLgi3sVc4
  • TLSH
    T107324A5503604AF3E986843C086A3BBF6F796B2196F04E53DFA384C0EE6D5C96D78352
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  3^/10

  discovery
  behavioral3behavioral4
• • Target
    $PLUGINSDIR/nsDialogs.dll
  • Size 9KB
  • SHA256 3cdf3e24c87666ed5c582b8b028c01ee6ac16d5a9b8d8d684ae67605376786ea
  • MD5 ab101f38562c8545a641e95172c354b4
  • SHA1 ec47ac5449f6ee4b14f6dd7ddde841a3e723e567
  • SHA512 72d4b6dc439f40b7d68b03353a748fc3ad7ed10b0401741c5030705d9b1adef856406075e9ce4f1a08e4345a16e1c759f636c38ad92a57ef369867a9533b7037
  • SSDEEP 96:o3W4JlD3c151V1gQoE8cxM2DjDf3GEst+Nt+jvcx4K8qndYv0PLE:o3p3ggQF8REskpxZdO0PLE
  • TLSH
    T13512F8235A4455B3C9E7223A31AA2F2ECB3C9324E0627D02C777DE562BF42166D3E355
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  3^/10

  discovery
  behavioral5behavioral6