Extracted

• • Target

    AMERICAN GROUP.js

  • Size

    5KB

  • MD5

    709df3d382b86fffeda0e0c534206ec1

  • SHA1

    570e38194e3d5e977af449ca2fe1ef9f05b9c7de

  • SHA256

    ca5a213e123d830ad88e6eb9da341326fa6ea6c5bb535069406f9454b5aecccc

  • SHA512

    8e6d6a7038ae9f3edcec8b2bdbb536f356fe565b11f6114fc06425a1e1efeaa84693e2750d3b4a843daccb799bfc37b8a6b0fd3d8296c43909174b5179ae2365

  • SSDEEP

    96:XHSZyZ020gtthyohPx1MMEqzHQH0TqfpkIiup77jIf:i/dyU4I370

  Score

  10^/10

  executionremcosezeifecollectioncredential_accessdiscoveryratspywarestealer

  • Remcos

    Remcos is a closed-source remote control and surveillance software.

    ratremcos

  • Credentials from Password Stores: Credentials from Web Browsers

    Malicious Access or copy of Web Browser Credential store.

    credential_accessstealer

  • Detected Nirsoft tools

    Free utilities often used by attackers which can steal passwords, product keys, etc.

  • NirSoft MailPassView

    Password recovery tool for various email clients

  • NirSoft WebBrowserPassView

    Password recovery tool for various web browsers

  • Blocklisted process makes network request

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Drops startup file

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Accesses Microsoft Outlook accounts

    collection

  • Command and Scripting Interpreter: PowerShell

    Using powershell.exe command.

    execution

  • Legitimate hosting services abused for malware hosting/C2

  • Suspicious use of SetThreadContext

  behavioral1behavioral2