Extracted

• • Target
    d060036bf0a5275d798388bb267893149c2a105cdeb6832a00a8b0d09447d827.exe
  • Size 1.2MB
  • SHA256 d060036bf0a5275d798388bb267893149c2a105cdeb6832a00a8b0d09447d827
  • MD5 8f18fc14a55303e4f18e46d6c9d53f5b
  • SHA1 91fba5580461db27d154077c63c6f1a5dafc043e
  • SHA512 fce6a16393848250659f285f7c7006cfd32c3fe4c005cb99c710e52a4fde6895a116b8320027ef471382c368010f290d6f2796769a67de851b9c6bee4008d369
  • SSDEEP 24576:4SATMMpkdsZGz0TkMlrxtzcOylVwRvD0e//ZqgZ:wpMWGziTtQbgvDt//ZF
  • TLSH
    T14045022839275503D9B27EF44D71F5B04B366DA96532D2A89ED60CDBBAE37003E12327
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  fx-mailcollectiondiscoveryexecutionremcospersistenceratspywarestealer

  • Family: Remcos

    Remcos is a closed-source remote control and surveillance software.

    ratremcos

  • Command and Scripting Interpreter: PowerShell

    Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

    execution

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Accesses Microsoft Outlook profiles

    collection

  • Adds Run key to start application

    persistence

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery

  • Suspicious use of SetThreadContext

  behavioral1behavioral2