Extracted

Extracted

• • Target

    MalwareBazaar.11

  • Size

    1.4MB

  • MD5

    962b35661c04b5bff3e3504f9cd646a7

  • SHA1

    1a1cd695804bd14e8e1ea64a21b2b81fe76baf6c

  • SHA256

    af0b876a436452a6e998fc622493aaa4553bcc53864d66a6a6d5d476a85902eb

  • SHA512

    a7b7fb2990abc7a73e0f5963c3ce72b1b18a37fb908ec069985bde616e7e8fcd75f288855ae33218e66b1483b7f2596bf4729e3cab9afb478fc37691488964ec

  • SSDEEP

    24576:dngozf6mbIWaZWazVXOLJPqEXN9/uZteoFjqQOy:dnVD6mkWawkXmPqEXN9mZteuj5/

  Score

  10^/10

  nanocoreremcosnewremotehostcollectioncredential_accessdiscoveryevasionexecutionkeyloggerpersistenceratspywarestealertrojan

  • NanoCore

    NanoCore is a remote access tool (RAT) with a variety of capabilities.

    keyloggertrojanstealerspywarenanocore

  • Remcos

    Remcos is a closed-source remote control and surveillance software.

    ratremcos

  • Credentials from Password Stores: Credentials from Web Browsers

    Malicious Access or copy of Web Browser Credential store.

    credential_accessstealer

  • Detected Nirsoft tools

    Free utilities often used by attackers which can steal passwords, product keys, etc.

  • NirSoft MailPassView

    Password recovery tool for various email clients

  • NirSoft WebBrowserPassView

    Password recovery tool for various web browsers

  • Command and Scripting Interpreter: PowerShell

    Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

    execution

  • Executes dropped EXE

  • Accesses Microsoft Outlook accounts

    collection

  • Adds Run key to start application

    persistence

  • Checks whether UAC is enabled

    evasiontrojan

  • Drops file in System32 directory

  • Suspicious use of SetThreadContext

  behavioral1