Extracted

• • Target

    AMERICAN GROUP.js

  • Size

    5KB

  • MD5

    5be88d052188df8add0940e02e81c7ba

  • SHA1

    f94e8408818fe5537653a25bc30dadd9dd1e274f

  • SHA256

    4858ae3bd1364f5c2246a46b84dc9abc15b1ea5ffc98a15dc5610b976042aea6

  • SHA512

    135e6707323d014de36ed1028ea7a5fd9ca4afcf15f8e5c65dc9bc8b22173f9990e71f1f7be1c693339df48cfb7e3fbc8c9b997b2901069334f4a605ed32c8b7

  • SSDEEP

    96:lkPtC7pMHzQL4hl0m5VqOM/C7yieEPjOQOUQ8CcZJEp6LWQPjwo47f:e879iUCFF9Q8Ccbj94r

  Score

  10^/10

  executionremcosezeifecollectioncredential_accessdiscoveryratspywarestealer

  • Remcos

    Remcos is a closed-source remote control and surveillance software.

    ratremcos

  • Credentials from Password Stores: Credentials from Web Browsers

    Malicious Access or copy of Web Browser Credential store.

    credential_accessstealer

  • Detected Nirsoft tools

    Free utilities often used by attackers which can steal passwords, product keys, etc.

  • NirSoft MailPassView

    Password recovery tool for various email clients

  • NirSoft WebBrowserPassView

    Password recovery tool for various web browsers

  • Blocklisted process makes network request

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Drops startup file

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Accesses Microsoft Outlook accounts

    collection

  • Command and Scripting Interpreter: PowerShell

    Using powershell.exe command.

    execution

  • Legitimate hosting services abused for malware hosting/C2

  • Suspicious use of SetThreadContext

  behavioral1behavioral2