Extracted

• • Target

    a60f72316633a40d5ab45b035ecd03b7cd0162ce161946cfa2ad86d11fbc9c13.rtf

  • Size

    71KB

  • MD5

    65e41469da1397e3e1c9d70fc29fe2e2

  • SHA1

    b234d40cee175effca9a503c908b408a91c7a7da

  • SHA256

    a60f72316633a40d5ab45b035ecd03b7cd0162ce161946cfa2ad86d11fbc9c13

  • SHA512

    22a75d17446e8b6556a1fb3fdb1f8f4671d3f894a717541c7b51861f1c87c2bdd593b998762b37b1844c9028d9cd79510a0414d87c79f679266b519f44e75c56

  • SSDEEP

    768:W7LVB2IIi5W8rLUAvwqKfGJp8pgpyPjwf7thRrmrPNq4kZ9Y7U3gJnKxBwDwA:mj2IIWWuI4yeJp8pgoP47lmrAz3g2Bql

  Score

  10^/10

  remcosremotehostcollectionpersistenceratspywarestealer

  • Remcos

    Remcos is a closed-source remote control and surveillance software.

    ratremcos

  • Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003)

  • Detects executables built or packed with MPress PE compressor

  • Detects executables referencing many confidential data stores found in browsers, mail clients, cryptocurreny wallets, etc. Observed in information stealers

  • Detects executables referencing many email and collaboration clients. Observed in information stealers

  • NirSoft MailPassView

    Password recovery tool for various email clients

  • NirSoft WebBrowserPassView

    Password recovery tool for various web browsers

  • Nirsoft

  • Blocklisted process makes network request

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Accesses Microsoft Outlook accounts

    collection

  • Adds Run key to start application

    persistence

  • Drops file in System32 directory

  • Suspicious use of SetThreadContext

  behavioral1behavioral2