Extracted

• • Target

    Virus.Danger.ATA_virussign.com_b050247ddb99e9969eabeba8b76eb491.exe

  • Size

    1.2MB

  • MD5

    b050247ddb99e9969eabeba8b76eb491

  • SHA1

    f899f777ee2827f7dc997dba67681936835acb3d

  • SHA256

    52f0c3471e31cea46fd5776acf896e557c3da55dc8966349b3939c51e3b6b82d

  • SHA512

    a909645475030ddf5f07853a7d6315dce996738d662539757c3fbe4e19c4c153e120e8add7ae6ff1532e6e56160c7acd1b13d63eba5e65a1943d5954211d438e

  • SSDEEP

    24576:xtb20pkaCqT5TBWgNQ7ay2js14tXE/D1Si5EGjN6A:CVg5tQ7ay2j9ED+GB5

  Score

  10^/10

  discoveryremcosedbracollectioncredential_accessratspywarestealer

  • Remcos

    Remcos is a closed-source remote control and surveillance software.

    ratremcos

  • Credentials from Password Stores: Credentials from Web Browsers

    Malicious Access or copy of Web Browser Credential store.

    credential_accessstealer

  • Detected Nirsoft tools

    Free utilities often used by attackers which can steal passwords, product keys, etc.

  • NirSoft MailPassView

    Password recovery tool for various email clients

  • NirSoft WebBrowserPassView

    Password recovery tool for various web browsers

  • Drops startup file

  • Executes dropped EXE

  • Loads dropped DLL

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Accesses Microsoft Outlook accounts

    collection

  • AutoIT Executable

    AutoIT scripts compiled to PE executables.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2