Extracted

• • Target
    Detailed products requirements, specs and drawing.exe
  • Size 1.2MB
  • SHA256 e7f98934ff5f88f0c2c0a49a46fa451a515544decf583cca69b489622efa1bc0
  • MD5 83578d10b2e7fa70a6112dcf66adac78
  • SHA1 dbe5b91f1db805dcd90bd44d9aa912fac7387bdf
  • SHA512 b425ac04045d31c6ee597ac5a6bf2edc43e88fa4e4d0eb2a5acc16aea6bf4e67440d652e62d15a34f5ffd0aeb98b82440a6a59d8e2b35c66c511702f380d638a
  • SSDEEP 24576:g1F9VxMn0CPWdPG83zpdO3iPIoQROpC35lqfn13CwO:g1fIPWd+azfIiJfn51
  • TLSH
    T18B45DF6072AAD806D5B61B72C8F1CAF817B17E49E831C20B47D97DEB3A327815D46393
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  remotehostcollectiondefense_evasiondiscoveryexecutionremcosratspywarestealercredential_accesstrojan

  • Family: Remcos

    Remcos is a closed-source remote control and surveillance software.

    ratremcos

  • UAC bypass

    defense_evasiontrojan

  • Command and Scripting Interpreter: PowerShell

    Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

    execution

  • Uses browser remote debugging

    Can be used to control the browser and steal sensitive information such as credentials and session cookies.

    credential_accessstealer

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Deletes itself

    defense_evasion

  • Loads dropped DLL

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Accesses Microsoft Outlook profiles

    collection

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery

  • Executes a VBScript file via the Windows Script Host.

    execution

  • Suspicious use of SetThreadContext

  behavioral1behavioral2