Extracted

• • Target

    French Group.js

  • Size

    4KB

  • MD5

    6ee09326b695eb925cb588f356f150b5

  • SHA1

    be4f216545675b93d29155448bd458ee7ac76cc4

  • SHA256

    0af34d9fcef61883a518db6237c7e6b969c21a0b2624b75062e19e7d02bc1120

  • SHA512

    0ba0035a9b89262aa2ac371baff07e2300658d7e8decfa57adeef70783c425a48197d8ed2f596e9df36519c563fd60fc54adc814b91b329b0426c6cb67ec1e8a

  • SSDEEP

    96:Boqd6varXgkeJPAGiWzL4X7ylKRUrX1/dR5AFHBWWQLTIH6HjUfuD:oPAGTzS7GKRUrX1/X5WWrLTIH6HjUuD

  Score

  10^/10

  executionremcosakpu idemilicollectioncredential_accessdiscoveryratspywarestealer

  • Remcos

    Remcos is a closed-source remote control and surveillance software.

    ratremcos

  • Credentials from Password Stores: Credentials from Web Browsers

    Malicious Access or copy of Web Browser Credential store.

    credential_accessstealer

  • Detected Nirsoft tools

    Free utilities often used by attackers which can steal passwords, product keys, etc.

  • NirSoft MailPassView

    Password recovery tool for various email clients

  • NirSoft WebBrowserPassView

    Password recovery tool for various web browsers

  • Blocklisted process makes network request

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Accesses Microsoft Outlook accounts

    collection

  • Command and Scripting Interpreter: PowerShell

    Using powershell.exe command.

    execution

  • Legitimate hosting services abused for malware hosting/C2

  • Suspicious use of SetThreadContext

  behavioral1behavioral2