Extracted

• • Target

    5394613c9b681a8f6735bbe9b0fcaafeb79c165211d9c1d202cb4372404b0df1.exe

  • Size

    1.2MB

  • MD5

    9f5ac77b66807ac0b2e0cedb9bb26491

  • SHA1

    d14a0038aabc6db37349438db80ddc907cd45e5c

  • SHA256

    5394613c9b681a8f6735bbe9b0fcaafeb79c165211d9c1d202cb4372404b0df1

  • SHA512

    acc60556ccc4d146604ac859c3c1d127bfc48127489791d013c78b041889a5d5d3e79132c54add761d3ec63025f06e5c62f8e4b88d11f3979af8360f21aa149b

  • SSDEEP

    24576:dAHnh+eWsN3skA4RV1Hom2KXMmHabuOq6jyl6Jp8vlzNXA/EEK0CwQAb5:8h+ZkldoPK8YabuOqqyJlzG40x

  Score

  10^/10

  discoveryremcosremotehostcollectioncredential_accessratspywarestealer

  • Remcos

    Remcos is a closed-source remote control and surveillance software.

    ratremcos

  • Credentials from Password Stores: Credentials from Web Browsers

    Malicious Access or copy of Web Browser Credential store.

    credential_accessstealer

  • Detected Nirsoft tools

    Free utilities often used by attackers which can steal passwords, product keys, etc.

  • NirSoft MailPassView

    Password recovery tool for various email clients

  • NirSoft WebBrowserPassView

    Password recovery tool for various web browsers

  • Drops startup file

  • Executes dropped EXE

  • Loads dropped DLL

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Accesses Microsoft Outlook accounts

    collection

  • AutoIT Executable

    AutoIT scripts compiled to PE executables.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2