Extracted

• • Target

    73c5b71d2923b11a8b262321c6229520c93115f82c78d742f041a650725d482f.rtf

  • Size

    63KB

  • MD5

    b5b2948d407676eab86b1152e7ce5ec4

  • SHA1

    85de7e562d97c36b9318393fd6185df6b1ba55b9

  • SHA256

    73c5b71d2923b11a8b262321c6229520c93115f82c78d742f041a650725d482f

  • SHA512

    b2048e775bccc0f0cc144fcfaa4e3067fa4ed2613f1e152323673c6497a82815d2ef366d29289214cf5f0007a3c8537af6f40b6ab07a1a936ed4f4612be9725a

  • SSDEEP

    1536:fgoIW1uYod+RuUl9Zh7teyDdvqMhRSiupwk8uXjlh17AY9j:otyuYod+RuAZh84vSiowk8uXjlh17AYR

  Score

  10^/10

  remcosremotehostcollectionpersistenceratspywarestealer

  • Remcos

    Remcos is a closed-source remote control and surveillance software.

    ratremcos

  • Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003)

  • Detects executables built or packed with MPress PE compressor

  • Detects executables referencing many confidential data stores found in browsers, mail clients, cryptocurreny wallets, etc. Observed in information stealers

  • Detects executables referencing many email and collaboration clients. Observed in information stealers

  • NirSoft MailPassView

    Password recovery tool for various email clients

  • NirSoft WebBrowserPassView

    Password recovery tool for various web browsers

  • Nirsoft

  • Blocklisted process makes network request

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Accesses Microsoft Outlook accounts

    collection

  • Adds Run key to start application

    persistence

  • Drops file in System32 directory

  • Suspicious use of SetThreadContext

  behavioral1behavioral2