Extracted

• • Target
    Bordbns.exe
  • Size 415KB
  • SHA256 b1ab36e342ada65f2ba8ebc069b3e6ab1c51c0a092e09addb8f3408cf8fbdf8a
  • MD5 fb5601dbb8729e3c028897e81f8a6561
  • SHA1 6c8f48c6fa37b84c11f477dfc1699e1f4d19cc08
  • SHA512 c412e4d4ed38459b2ba3a7a01b15825c0dc5b7e7b230b1bff4f279183b72ec8bd3b73de0e256ddc6b1251afee8bdb626b49d6e24ca56efeb1390be0bca946870
  • SSDEEP 6144:nyINO+ZYJH4Zbnqd5+yDKi9h8jRp7UWTvr3+KgerLQ82MbB7FPpHJkx:3FCJH4N9yD9hMvUWTvr3+KgALQ8/NJi
  • MD5 SHA1 SHA512 SSDEEP

  Score

  10^/10

  remcosremotehostratcollectionspywarestealer

  • Remcos

    Remcos is a closed-source remote control and surveillance software.

    ratremcos

  • NirSoft MailPassView

    Password recovery tool for various email clients

  • NirSoft WebBrowserPassView

    Password recovery tool for various web browsers

  • Nirsoft

  • Loads dropped DLL

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Accesses Microsoft Outlook accounts

    collection

  • Suspicious use of NtCreateThreadExHideFromDebugger

  • Suspicious use of NtSetInformationThreadHideFromDebugger

  • Suspicious use of SetThreadContext

  behavioral1behavioral2
• • Target
    $PLUGINSDIR/System.dll
  • Size 11KB
  • SHA256 fa4ab1d6f79fd677433a31ada7806373a789d34328da46ccb0449bbf347bd73e
  • MD5 3f176d1ee13b0d7d6bd92e1c7a0b9bae
  • SHA1 fe582246792774c2c9dd15639ffa0aca90d6fd0b
  • SHA512 0a69124819b7568d0dea4e9e85ce8fe61c7ba697c934e3a95e2dcfb9f252b1d9da7faf8774b6e8efd614885507acc94987733eba09a2f5e7098b774dfc8524b6
  • SSDEEP 192:OPtkumJX7zB22kGwfy0mtVgkCPOsX1un:/702k5qpdsXQn
  • MD5 SHA1 SHA512 SSDEEP

  Score

  3^/10
  behavioral3behavioral4