Extracted

• • Target
    c6e661d982981e4de5cbcba98e28bac1aa3a9518d4e5c605680480962f917c32.exe
  • Size 411KB
  • SHA256 c6e661d982981e4de5cbcba98e28bac1aa3a9518d4e5c605680480962f917c32
  • MD5 1799424409d5e0099fa315a0aa11b36a
  • SHA1 53007977e7eda1a6ab8cddfe2a7d882b8eb820b4
  • SHA512 3c37a3c61575425d5c8636bc81ea91c23e9ee4243d9517cdd70c78139c3f9a531b265ae87f0cdcb7ab2e81edcdbe10f273af042a507cfc021adadd75b9450b3c
  • SSDEEP 6144:Y7eCd6puQeCTGkiq0DYhgmZ0uPNrCSlbYnVannn/hygOdtUwj0TnmuqXdy:6PqGZSPNm+bYnVa/hygoRu6XU
  • MD5 SHA1 SHA512 SSDEEP

  Score

  10^/10

  remcosclientcollectionpersistenceratspywarestealer

  • Remcos

    Remcos is a closed-source remote control and surveillance software.

    ratremcos

  • NirSoft MailPassView

    Password recovery tool for various email clients

  • NirSoft WebBrowserPassView

    Password recovery tool for various web browsers

  • Nirsoft

  • Loads dropped DLL

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Accesses Microsoft Outlook accounts

    collection

  • Adds Run key to start application

    persistence

  • Suspicious use of NtCreateThreadExHideFromDebugger

  • Suspicious use of NtSetInformationThreadHideFromDebugger

  • Suspicious use of SetThreadContext

  behavioral1behavioral2
• • Target
    $PLUGINSDIR/System.dll
  • Size 11KB
  • SHA256 a1390a78533c47e55cc364e97af431117126d04a7faed49390210ea3e89dd0e1
  • MD5 fbe295e5a1acfbd0a6271898f885fe6a
  • SHA1 d6d205922e61635472efb13c2bb92c9ac6cb96da
  • SHA512 2cb596971e504eaf1ce8e3f09719ebfb3f6234cea5ca7b0d33ec7500832ff4b97ec2bbe15a1fbf7e6a5b02c59db824092b9562cd8991f4d027feab6fd3177b06
  • SSDEEP 192:yPtkiQJr7V9r3Ftr87NfwXQ6whlgi62V7i77blbTc4DI:N7Vxr8IgLgi3sVc4
  • MD5 SHA1 SHA512 SSDEEP

  Score

  3^/10
  behavioral3behavioral4