Extracted

• • Target
    Request For Quotation_docs.scr
  • Size 1.8MB
  • SHA256 66d384f935d74fd0b94f60ec85895a64c4871036b3b06071d16f4204e0936b88
  • MD5 07a4894baa4c710ed3a04c9940e932a6
  • SHA1 06db13017370c39d36b0da814933ee5b1642b039
  • SHA512 6bc72635e02cb2840bfd5638c0455ede57851fc284dba7a835aa003b2b02e678cc2bc130ae8e12779a6f7b5b003a4200159195fc2209688faecf93fb82404edd
  • SSDEEP 24576:QcFwPgG9r7hicluHwR9AVEGoqgkW+jYZy8UG0VKHAQR+ioJ:73OBcHwKEXfwlVtQRa
  • TLSH
    T1F4957A5B3101FDAFC43698318961D9B079D02F55B306F23754933EAB7A3B96E8A33192
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  july24-2026collectiondiscoveryexecutionremcospersistenceratspywarestealer

  • Family: Remcos

    Remcos is a closed-source remote control and surveillance software.

    ratremcos

  • Command and Scripting Interpreter: PowerShell

    Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

    execution

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Accesses Microsoft Outlook profiles

    collection

  • Adds Run key to start application

    persistence

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery

  • Suspicious use of SetThreadContext

  behavioral1behavioral2