Extracted

• • Target
    4da2425b6d3677ff80e52dd880a6f718257ad3c15deb565cd947b6f3aa05a9eb.exe
  • Size 4.5MB
  • SHA256 4da2425b6d3677ff80e52dd880a6f718257ad3c15deb565cd947b6f3aa05a9eb
  • MD5 78b70273fc590fab5bd01c8ea21363be
  • SHA1 49cbf6c36dd5906bd73df3193d0f824e1664fbc0
  • SHA512 368234ed7ee48e83554336463efcb0ca62b0d38622b97b6e8d3574f5ab61da81a609c2993524ffc1ef55c38f8ab3bc7e7e1ed95a509f49f78f7f032332e539e5
  • SSDEEP 98304:iXLDad9OX3peer4RENS0WkIwHyEo1q8lSJBQwLOSnY3hO+WJMvJrfpMa/RE6GUkH:cLDavQ3pew4RtRgyH1q8o23hzWJ+h/Pi
  • TLSH
    T18D26AEB1A3C4E5A5C41EDA34D730E233C1727D224A75908E198AF706EFB69527BFA701
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  adwareremotehostcollectiondiscoveryexecutionformbookremcospersistenceratspywarestealersuricatatrojan

  • Family: Formbook

    Formbook is a data stealing malware which is capable of stealing data.

    trojanspywarestealerformbook

  • Family: Remcos

    Remcos is a closed-source remote control and surveillance software.

    ratremcos

  • Formbook payload

    rat

  • Suricata alert: REMCOS RAT Malware Inbound C2 Communication

    Network activity triggered a Suricata alert

    suricataremcos

  • Suricata alert: REMCOS RAT Malware Outbound C2 Communication

    Network activity triggered a Suricata alert

    suricataremcos

  • Command and Scripting Interpreter: PowerShell

    Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

    execution

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Accesses Microsoft Outlook profiles

    collection

  • Adds Run key to start application

    persistence

  • SmartAssembly .NET packer

    Detects SmartAssembly .NET packer.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2