Extracted

• • Target
    b856704dcb7b2f172d96f5a804628bc5ce615c7750a952b88eff541f16d5afe1.exe
  • Size 994KB
  • SHA256 b856704dcb7b2f172d96f5a804628bc5ce615c7750a952b88eff541f16d5afe1
  • MD5 f71681e3d2ab2b351dcafd96d1ebc9b3
  • SHA1 3ac43b83c9563d31be2a71e945eb9c1fdf362d74
  • SHA512 f4d5c303e66bf82f722ec213714bee5d1aaf08e0d86401d6b2da98282c56cfadfcc0978e562ce263f28f49384b39bd3686d698b9909f423081ed5d3e88db7a08
  • SSDEEP 24576:cJZ8cHObaV05PWu6lCVIrLhLL8WlI5XcGgQ:5cp8eu6wqrR3lI5XcG
  • TLSH
    T13B2512156B8BDC13C4761BB928D2D23013350DCAA463D06B5FDA3EDB3A36BA59AC4743
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  don32upxcollectiondiscoveryevasionexecutionremcospersistenceratspywarestealertrojanupx

  • Family: Remcos

    Remcos is a closed-source remote control and surveillance software.

    ratremcos

  • Modifies Windows Defender DisableAntiSpyware settings

    evasiontrojan

  • Command and Scripting Interpreter: PowerShell

    Run Powershell and hide display window.

    execution

  • Executes dropped EXE

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Accesses Microsoft Outlook profiles

    collection

  • Adds Run key to start application

    persistence

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery

  • Suspicious use of SetThreadContext

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  behavioral1behavioral2