Extracted

• • Target

    Nicht bestätigt 44301.crdownload

  • Size

    1.5MB

  • MD5

    dd1e9bbd16698d52fb6501664beabde6

  • SHA1

    d985290853ab46a1d98fa23b33ed003500c71bae

  • SHA256

    ef43e9475ed3cf0420900e7f29345c646978eaf6b9ae749bfe265061dfdc172b

  • SHA512

    f9650ecd6063c7e8a0a24806d30ebc66dea261711241ab2a8eca675949860fc87e3e2ff53c5d4279a7fcd8979405f459e5058b098e5ba5398bfbdb23c34a09fd

  • SSDEEP

    49152:kUKg7X7cHxjXoNXhXcmpQGpk03bFDDIfgNz:kUj7UXoNhXcHq3b2YNz

  Score

  10^/10

  remcosremotehostcollectionratspywarestealer

  • Remcos

    Remcos is a closed-source remote control and surveillance software.

    ratremcos

  • NirSoft MailPassView

    Password recovery tool for various email clients

  • NirSoft WebBrowserPassView

    Password recovery tool for various web browsers

  • Nirsoft

  • Loads dropped DLL

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Accesses Microsoft Outlook accounts

    collection

  • Suspicious use of NtCreateThreadExHideFromDebugger

  • Suspicious use of NtSetInformationThreadHideFromDebugger

  • Suspicious use of SetThreadContext

  behavioral1behavioral2