Extracted

Extracted

• • Target

    5e83e78d0fe81ef4fdeb85e1a97ee390aa9259349ba37abb7e32648ee2246404.rtf

  • Size

    10KB

  • MD5

    68e4e02abb6cfe1a980aa3a97bcad4f8

  • SHA1

    15885c44c852a92ccb8beb656e6f9e788794f833

  • SHA256

    5e83e78d0fe81ef4fdeb85e1a97ee390aa9259349ba37abb7e32648ee2246404

  • SHA512

    dfbaac2b0cd9a0904f703f65708a267f13fd05d3510476ee6915ff5a1ce87440d4613f0ebaeae23ed4799c9fc51f10f8cf0833515b369c2c6feb49df7031562b

  • SSDEEP

    192:iAum75aReNM6p05FiVB+YjY+NYjRiUkqjZvWgtLChIvJZqc5vEQrfcPZSPmfzezZ:ihZGMJiPv8IYjUUDjZvWg1Ch2ZBvEQjx

  Score

  10^/10

  formbookremcosremotehostdcn0collectionratspywarestealertrojanupx

  • Formbook

    Formbook is a data stealing malware which is capable of stealing data.

    trojanspywarestealerformbook

  • Remcos

    Remcos is a closed-source remote control and surveillance software.

    ratremcos

  • NirSoft MailPassView

    Password recovery tool for various email clients

  • NirSoft WebBrowserPassView

    Password recovery tool for various web browsers

  • Nirsoft

  • Blocklisted process makes network request

  • Downloads MZ/PE file

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx

  • Uses the VBS compiler for execution

  • Accesses Microsoft Outlook accounts

    collection

  • Suspicious use of SetThreadContext

  behavioral1behavioral2