Extracted

Extracted

• • Target

    sweetchcobarmilkbunwithgreatsweet.tIF

  • Size

    184KB

  • MD5

    09c311fde82907d15d6c211cba5102fe

  • SHA1

    878ac6d6e1161babad2a8cf5fcec2361ff4936dd

  • SHA256

    5e8cf043fa42fd8892c72fbdbf02c1023b1379322be23c213cfba5b8ae196f33

  • SHA512

    758ed3c2cf758604e34ca0fe6c96f396e76728893377e983a07eca19838634954a0c70216e7416107e45404c9340498689d1363b08f4c2ac12c668dfb04185d5

  • SSDEEP

    3072:DEx+vVuJ/1T6BxNyYI1gt5pXGw6IzS71lUOceP9LVGbGu:A4tuR1Tax/IPUde9RMB

  Score

  10^/10

  executionremcoszynovacollectioncredential_accessdiscoveryratspywarestealer

  • Remcos

    Remcos is a closed-source remote control and surveillance software.

    ratremcos

  • Credentials from Password Stores: Credentials from Web Browsers

    Malicious Access or copy of Web Browser Credential store.

    credential_accessstealer

  • Detected Nirsoft tools

    Free utilities often used by attackers which can steal passwords, product keys, etc.

  • NirSoft MailPassView

    Password recovery tool for various email clients

  • NirSoft WebBrowserPassView

    Password recovery tool for various web browsers

  • Blocklisted process makes network request

  • Command and Scripting Interpreter: PowerShell

    Run Powershell and hide display window.

    execution

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Accesses Microsoft Outlook accounts

    collection

  • Suspicious use of SetThreadContext

  behavioral1behavioral2