Extracted

• • Target

    e309d1d65510a23a42802d4fefe26620N.exe

  • Size

    874KB

  • MD5

    e309d1d65510a23a42802d4fefe26620

  • SHA1

    07c0d5f0ae07a6ee4c039050f8c26beb6216419b

  • SHA256

    99bcee03cdb32c2bcf607b82e750d90ee4c0ca9e37f784ca4cd3e4b888977e58

  • SHA512

    31f5e77bf4a35e76c6b5328c5ad3c540c64df74b48ce7954118c728e52ae069fb3fca17ac8b2c83624fd528702772450781d013df91f8d0b67e93c2131b6db87

  • SSDEEP

    24576:KBXu9HGaVHjdjRxKPzRkRYoNjRCLOU/vh37:Kw9VHjdtxKrRkZNIOUnh

  Score

  10^/10

  remcosremotehostcollectioncredential_accessdiscoveryratstealerupx

  • Remcos

    Remcos is a closed-source remote control and surveillance software.

    ratremcos

  • Credentials from Password Stores: Credentials from Web Browsers

    Malicious Access or copy of Web Browser Credential store.

    credential_accessstealer

  • Detected Nirsoft tools

    Free utilities often used by attackers which can steal passwords, product keys, etc.

  • NirSoft MailPassView

    Password recovery tool for various email clients

  • NirSoft WebBrowserPassView

    Password recovery tool for various web browsers

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx

  • Accesses Microsoft Outlook accounts

    collection

  • AutoIT Executable

    AutoIT scripts compiled to PE executables.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2