Extracted

Extracted

• • Target

    961c9c4f65267e43e44e13b6bf265f6f.exe

  • Size

    328KB

  • MD5

    961c9c4f65267e43e44e13b6bf265f6f

  • SHA1

    33776c4a9f5989f733f6047cd3fbecb488d1688b

  • SHA256

    156432010c9c69932d05b3420b22ae89d29e4d858e0626031ed4856f1b3a00cd

  • SHA512

    40518c46518d6170793acbf7322b0ffebdafe38c627ec0810444b02ed73c4a5a2bc3bedde39dc6c6d214e6db33cfc253ffda6264bde9559b7593e9b6fdab20bb

  • SSDEEP

    6144:+Ya6e3D2t9hg068nDs+wW2bRmLhW4dlNNwl4jmfX5GJBL12Q0u:+YY3D2L68nDdwW2VUJdlNNQkmv5GZ2Qf

  Score

  10^/10

  formbookremcosremotehostho62collectionratspywarestealertrojanupx

  • Formbook

    Formbook is a data stealing malware which is capable of stealing data.

    trojanspywarestealerformbook

  • Remcos

    Remcos is a closed-source remote control and surveillance software.

    ratremcos

  • Formbook payload

    rat

  • NirSoft MailPassView

    Password recovery tool for various email clients

  • NirSoft WebBrowserPassView

    Password recovery tool for various web browsers

  • Nirsoft

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx

  • Accesses Microsoft Outlook accounts

    collection

  • Suspicious use of SetThreadContext

  behavioral1behavioral2