Extracted

• • Target

    FRENCH GROUP.js

  • Size

    4KB

  • MD5

    dadd8377507e2d1e1f9d6d3932247793

  • SHA1

    db6d40ce027a73e60387f3787e0e21f0f23a24be

  • SHA256

    36c49be8996bd1fb40e29a22b26feff1a0081adbb319ab6ccbda80ef81376116

  • SHA512

    e20deb4608cdead3d79bc9d7a404a8e7fd47648aa44651d2a25dcccaa859baccce3238fe942a399b54ede7130e916fc60eba24a0031fcb219cf61c624810d367

  • SSDEEP

    96:FFAo42THsHlhnWbzFlWxCi+uYBZFO6UxOWlTtMIRdSMdfLCVjBw:rpqhnWvFldT1ZFsxTRRdSM1LCVjBw

  Score

  10^/10

  executionremcosidemili akpucollectioncredential_accessdiscoveryratspywarestealer

  • Remcos

    Remcos is a closed-source remote control and surveillance software.

    ratremcos

  • Credentials from Password Stores: Credentials from Web Browsers

    Malicious Access or copy of Web Browser Credential store.

    credential_accessstealer

  • Detected Nirsoft tools

    Free utilities often used by attackers which can steal passwords, product keys, etc.

  • NirSoft MailPassView

    Password recovery tool for various email clients

  • NirSoft WebBrowserPassView

    Password recovery tool for various web browsers

  • Blocklisted process makes network request

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Accesses Microsoft Outlook accounts

    collection

  • Command and Scripting Interpreter: PowerShell

    Using powershell.exe command.

    execution

  • Legitimate hosting services abused for malware hosting/C2

  • Suspicious use of SetThreadContext

  behavioral1behavioral2