Extracted

• • Target
    wegivingsomethingbiggerthingswithmebetterforme.hta
  • Size 37KB
  • SHA256 ae593f0773938ade4a4dfdd2f49d47b66482cd4090f269ef39549f12a90ee80c
  • MD5 a8bdcda3932ea297c0055cdd5b80583c
  • SHA1 bd5ad3b7cdad6da71663f37199cf286c1fef4559
  • SHA512 7db7f3d73abb4220442a7a3eefac044929377b497d00a8cbea9445bcb043ab6ba351663fa3d8d236bfe4cffab6bcbfde790137a7ea960c7a60b51b252c606b5a
  • SSDEEP 192:rjg6SHASX9yjRJS1Ntjpjcj8jMj7ajUjdNjkjWjK9vkxX9:rjg6QAY9yjRJqNits9vkxX9
  • TLSH
    T1EE031A7F69B4B40DE6EDA279063453081EC450F922B99289351FC2D317B9ADF3C91768
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  upx64collectiondiscoveryremcosratspywarestealerupx

  • Family: Remcos

    Remcos is a closed-source remote control and surveillance software.

    ratremcos

  • Badlisted process makes network request

    Network request originating from process or tool commonly abused by malware.

  • Downloads MZ/PE file

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Accesses Microsoft Outlook profiles

    collection

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery

  • Suspicious use of NtSetInformationThreadHideFromDebugger

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  behavioral1behavioral2