Extracted

• • Target

    Documento_Orslgroup_S.R.L_09_2023.doc

  • Size

    191KB

  • MD5

    68297123bc1ddbbd9336aa121a9dd534

  • SHA1

    2d8016319edb893e0ae600ba8c89f00a30466967

  • SHA256

    17cfb90deb531e2068d99e671423d8d1bcf8f06a0e2666f0108ca8e8b706dd1b

  • SHA512

    29e3e9e7e8a1b5c9fd54d97379e7f73cc2ee8174b950d7bf1b44f6f129893d6dec64c8ddb63f071184ea93bc88f1e5b7d0e1f99304c4af54f42af9042f6d092b

  • SSDEEP

    3072:SbiyWTxSoVHpNY6nemhInf/va46YP6z+dzL:miyWTwoVHp6m0/yl6H9L

  Score

  10^/10

  bitratxenarmorcollectionpasswordrecoveryspywarestealertrojanupx

  • BitRAT

    BitRAT is a remote access tool written in C++ and uses leaked source code from other families.

    trojanbitrat

  • Process spawned unexpected child process

    This typically indicates the parent process was compromised via an exploit or macro.

  • XenArmor Suite

    XenArmor is as suite of password recovery tools for various application.

    recoverypasswordxenarmor

  • Blocklisted process makes network request

  • Downloads MZ/PE file

  • ACProtect 1.3x - 1.4x DLL software

    Detects file using ACProtect software.

  • Executes dropped EXE

  • Loads dropped DLL

  • Reads data files stored by FTP clients

    Tries to access configuration files associated with programs like FileZilla.

    spywarestealer

  • Reads local data of messenger clients

    Infostealers often target stored data of messaging applications, which can include saved credentials and account information.

    spywarestealer

  • Reads user/profile data of local email clients

    Email clients store some user data on disk where infostealers will often target it.

    spywarestealer

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx

  • Accesses Microsoft Outlook accounts

    collection

  • Suspicious use of NtSetInformationThreadHideFromDebugger

  • Suspicious use of SetThreadContext

  behavioral1behavioral2