Extracted

Extracted

• • Target
    Төлемді растау.js
  • Size 1.0MB
  • SHA256 59d8e7c85e8d1eefcd71c27d522a4877d7017744e54b60d2573e97e25d22ad96
  • MD5 9f49c5a03817bc623893a25ad901a352
  • SHA1 3772b81cbb6c59fa20c9f1a83cf6596eb08ed160
  • SHA512 c9b15b3f47a8eb0c8bb982e7607c74bd614b40fe61fd979a96a461a0a230923119734c3d5ca96eb90b5f8abb9b548da4e6e93561ca9e21ab30e1a667bce13ba6
  • SSDEEP 24576:r9oClp473F12EkMZnAk6dXomuBxLZ0iO2Lo4Ps:u0aLF7Zymr7ezB2s
  • TLSH
    T1073502300B822FB58EBB050C90FD1706DED23E5F4A6AB64D9F93EBC51EF251A0616197
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  remotehostdiscoveryexecutionremcospersistenceprivilege_escalationratcollectionspywarestealer

  • Family: Remcos

    Remcos is a closed-source remote control and surveillance software.

    ratremcos

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Creates a file in the Startup directory

    A file was written to a Windows startup folder. Files in these directories are executed automatically when a user logs on or an application initializes.

    persistenceprivilege_escalation

  • Executes dropped EXE

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Accesses Microsoft Outlook profiles

    collection

  • Adds Run key to start application

    persistence

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  behavioral1behavioral2