Extracted

• • Target
    2fe40aab3d91258917f8cf03b34696e5a9d4dc80d2b139aa07e40b1d2706cee9
  • Size 1.2MB
  • SHA256 2fe40aab3d91258917f8cf03b34696e5a9d4dc80d2b139aa07e40b1d2706cee9
  • MD5 cd4973fde4bf9ac55caa1922e3b53247
  • SHA1 6deb3a223d4916336cbecba5e041c9de24b9b68b
  • SHA512 d98b2a785a438c4269fe1c4af484aa0923b435de44088d655775d56870545a5481d610ec687455c1f8e1f37287ab0c2fbbd213a78b2cc60e9d4d977f86d6a644
  • SSDEEP 24576:qz1L8GQuPAUKI2GUt6unBEQW6g/tIdw957JyNQ/CrB8NNt72:uJ5QuPMtJnBE4GIdw576CNv
  • TLSH
    T1094523897BA94103EAB74BFA2A76D23503B41DAD6630C5590FCA5DEF77277740A20703
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  remotehostcollectiondefense_evasiondiscoveryexecutionremcospersistencerattrojancredential_accessstealer

  • Family: Remcos

    Remcos is a closed-source remote control and surveillance software.

    ratremcos

  • UAC bypass

    defense_evasiontrojan

  • Command and Scripting Interpreter: PowerShell

    Run Powershell and hide display window.

    execution

  • Command and Scripting Interpreter: PowerShell

    Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

    execution

  • Uses browser remote debugging

    Can be used control the browser and steal sensitive information such as credentials and session cookies.

    credential_accessstealer

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Accesses Microsoft Outlook profiles

    collection

  • Adds Run key to start application

    persistence

  • Suspicious use of SetThreadContext

  behavioral1behavioral2