Extracted

• • Target

    NXP ALTERHA CHEM U946-874987.exe

  • Size

    1.3MB

  • MD5

    5d5e76e709b1df312317562127d3d0c0

  • SHA1

    7ea6bbc7ec194f2b38abba2b759574e801a824f9

  • SHA256

    f853dbba694560317f4d0673da02ae77afce25d7eb4dc62f02ed0f5c750ce861

  • SHA512

    b52163cbbd7b48a51ed88668c4f424b95961678c91a9e24026b7967fda12bab710b4a86a5e2e075b30082727f34603e35890305c6bb057df62c71aa28c6f0358

  • SSDEEP

    24576:ce12zVZ97Dc+6yvxly1dJquB9SsFOrOHXLzCIrn0WRO5z:ceAR37P0fkoQbO10u

  Score

  10^/10

  remcosremotehostcollectionpersistenceratspywarestealer

  • Remcos

    Remcos is a closed-source remote control and surveillance software.

    ratremcos

  • NirSoft MailPassView

    Password recovery tool for various email clients

  • NirSoft WebBrowserPassView

    Password recovery tool for various web browsers

  • Nirsoft

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Accesses Microsoft Outlook accounts

    collection

  • Adds Run key to start application

    persistence

  • Suspicious use of SetThreadContext

  behavioral1behavioral2