Extracted

• • Target
    DOCUMENT.exe
  • Size 715KB
  • SHA256 6ac986e8a1d186735ff4116474abb8de5da5cb51c3cc980bc21c37b4cdeb7b62
  • MD5 6a4400b6d5ded18fff7c2f6886814d0a
  • SHA1 dc41822acc8edf8d0e130321cbb53f5c1186075a
  • SHA512 de2fbb159e3318d691040680a6995ac47cbb28428f5a3da80d04d677f7d6614b61f28881566fc5e48be3eb8f90a55d7cd5d1e13514ce9f6c9449db9ee659e5ff
  • SSDEEP 12288:Gzt8QKGxDsV/VQyD5p0mwzO52MOCwRm+kg+QXLzlTT45P07dNVPv31mdbzf1BRCg:GzKQRxAJLwPm+3PX945INVPdmJf1BUTc
  • MD5 SHA1 SHA512 SSDEEP

  Score

  10^/10

  remcosremotehostcollectiondiscoveryratspywarestealer

  • Remcos

    Remcos is a closed-source remote control and surveillance software.

    ratremcos

  • NirSoft MailPassView

    Password recovery tool for various email clients

  • NirSoft WebBrowserPassView

    Password recovery tool for various web browsers

  • Nirsoft

  • Checks QEMU agent file

    Checks presence of QEMU agent, possibly to detect virtualization.

  • Loads dropped DLL

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Accesses Microsoft Outlook accounts

    collection

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery

  • Legitimate hosting services abused for malware hosting/C2

  • Suspicious use of NtCreateThreadExHideFromDebugger

  • Suspicious use of NtSetInformationThreadHideFromDebugger

  • Suspicious use of SetThreadContext

  behavioral1behavioral2