Extracted

• • Target

    b8022e8002a8e01a6364fdcc6d53275b6edf3d196e36f0b4c9645de2570cfd48.exe

  • Size

    1.5MB

  • MD5

    bd6420aaf066a5b4533598417866bc67

  • SHA1

    cf56376da61f4f34034fa4cc525e708052a5ecd3

  • SHA256

    b8022e8002a8e01a6364fdcc6d53275b6edf3d196e36f0b4c9645de2570cfd48

  • SHA512

    d9b394fc25949d552b64061810cd4452d24ee473c5755bada25b1db5ad35652a57b545c53c5e1dea88feac376b86e838a6b87886e9ad50e1f582eb2b985cda78

  • SSDEEP

    24576:zqDEvCTbMWu7rQYlBQcBiT6rprG8auS2rwF3q65FE8wvsO5BaH3:zTvC/MTQYxsWR7auSY65G8wDKH

  Score

  10^/10

  discoveryremcosremotehostcollectioncredential_accessratspywarestealer

  • Remcos

    Remcos is a closed-source remote control and surveillance software.

    ratremcos

  • Credentials from Password Stores: Credentials from Web Browsers

    Malicious Access or copy of Web Browser Credential store.

    credential_accessstealer

  • Detected Nirsoft tools

    Free utilities often used by attackers which can steal passwords, product keys, etc.

  • NirSoft MailPassView

    Password recovery tool for various email clients

  • NirSoft WebBrowserPassView

    Password recovery tool for various web browsers

  • Drops startup file

  • Executes dropped EXE

  • Loads dropped DLL

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Accesses Microsoft Outlook accounts

    collection

  • AutoIT Executable

    AutoIT scripts compiled to PE executables.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2