Extracted

Extracted

• • Target

    INQUIRY#46789-SEPT24.js

  • Size

    598KB

  • MD5

    c8b12fea7ec0d77f7eadb64361e5468a

  • SHA1

    f519767ce53d69819384afc7d545f3c5940ae717

  • SHA256

    337aa8b9b2cdaca9eae51830b6ccc6040339a93f3dd0f1946ffb0a697e4a9bb9

  • SHA512

    9b52cb572f6fdbb1c66ac582e41d2ed8fef9130e311f9b8b2429197c6c0ba7ab3776c5ca2d3140aee6a74ec79d824b0d8410a7b3f4469cf6b07435a89d554542

  • SSDEEP

    12288:SjoTUozZchVveIdNgwQrzQ6EFwg8VfEkNmDDjHO28gKMaNUeRWoTqLzBFdkVVM4X:QwJc8Fl2WI4T8LG

  Score

  10^/10

  executionremcosaugcollectioncredential_accessdiscoverypersistenceratstealer

  • Remcos

    Remcos is a closed-source remote control and surveillance software.

    ratremcos

  • Credentials from Password Stores: Credentials from Web Browsers

    Malicious Access or copy of Web Browser Credential store.

    credential_accessstealer

  • Detected Nirsoft tools

    Free utilities often used by attackers which can steal passwords, product keys, etc.

  • NirSoft MailPassView

    Password recovery tool for various email clients

  • NirSoft WebBrowserPassView

    Password recovery tool for various web browsers

  • Blocklisted process makes network request

  • Command and Scripting Interpreter: PowerShell

    Run Powershell and hide display window.

    execution

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Accesses Microsoft Outlook accounts

    collection

  • Adds Run key to start application

    persistence

  • Suspicious use of SetThreadContext

  behavioral1behavioral2