Extracted

• • Target
    60f99991b72a6f5271b814981068b5dbac7fe7ea114ef5f3295657a460ad42cb.exe
  • Size 954KB
  • SHA256 60f99991b72a6f5271b814981068b5dbac7fe7ea114ef5f3295657a460ad42cb
  • MD5 19b1fa8f88002e3489da53fd6d0c0e64
  • SHA1 f08108fbd4dcbea2dceda2caede56bbc0becb181
  • SHA512 f1570497954b84e1f6f8ffd198250baa70bd2cb0bc3b9ec403841827b7b2487bac0bc99b7c6da026edd2b0873e3caacef084e9bf7de70b974e8c236cc7c910d0
  • SSDEEP 24576:inlJOd6eWvhORe0ykZDh0gZd1ufKTfHh+c:iny6eWpIy2hYiTHcc
  • TLSH
    T13425128832498B1BEC765BF14B62E07453B18D9E7825E3168FC93DEB7B7AB410564E03
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  don32upxcollectiondiscoveryevasionexecutionremcospersistenceratspywarestealertrojanupx

  • Family: Remcos

    Remcos is a closed-source remote control and surveillance software.

    ratremcos

  • Modifies Windows Defender DisableAntiSpyware settings

    evasiontrojan

  • Command and Scripting Interpreter: PowerShell

    Run Powershell and hide display window.

    execution

  • Executes dropped EXE

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Accesses Microsoft Outlook profiles

    collection

  • Adds Run key to start application

    persistence

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery

  • Suspicious use of SetThreadContext

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  behavioral1behavioral2