Extracted

• • Target
    f3241ace2c07ddccf58c09add567265ea2ad9ff820bf696db21cc8f3642c2779.exe
  • Size 1.1MB
  • SHA256 f3241ace2c07ddccf58c09add567265ea2ad9ff820bf696db21cc8f3642c2779
  • MD5 43fc33e9d0b3ff57eef8b3b44cb35367
  • SHA1 6a49b35ad439fb057e60d6b2a82553524fc73332
  • SHA512 786ff26eafdb670cba8723e8690d3f70526eb8a6ff3186333be6108dcd9511f28bdd1d1672bdb144fcb08484368a7212a992afcf49b6f0d3285182bf33946a51
  • SSDEEP 24576:Nzn5JEdb6mDmPl+C6U7XCnlutUo8UVBaBgDngD8eU:pn55mDssCPSnlSn8UVBaBgTgD8eU
  • MD5 SHA1 SHA512 SSDEEP

  Score

  10^/10

  remcosremotehostdiscoveryexecutionratcollectioncredential_accessspywarestealer

  • Remcos

    Remcos is a closed-source remote control and surveillance software.

    ratremcos

  • Credentials from Password Stores: Credentials from Web Browsers

    Malicious Access or copy of Web Browser Credential store.

    credential_accessstealer

  • Detected Nirsoft tools

    Free utilities often used by attackers which can steal passwords, product keys, etc.

  • NirSoft MailPassView

    Password recovery tool for various email clients

  • NirSoft WebBrowserPassView

    Password recovery tool for various web browsers

  • Executes dropped EXE

  • Loads dropped DLL

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Accesses Microsoft Outlook accounts

    collection

  • Suspicious use of NtCreateThreadExHideFromDebugger

  • Suspicious use of NtSetInformationThreadHideFromDebugger

  • Suspicious use of SetThreadContext

  behavioral1behavioral2