Extracted

• • Target

    8dd3a8d57533cddb053799ed6f14291ed97042e9209870f8daa0a8eeb9223d38.exe

  • Size

    937KB

  • MD5

    d153584c42340d402d6e44454c3ad5b2

  • SHA1

    e14bfbe2f059a26e75755e29f032c5e0d3cf673c

  • SHA256

    8dd3a8d57533cddb053799ed6f14291ed97042e9209870f8daa0a8eeb9223d38

  • SHA512

    599b52b887b1c71515ec37ac072b4201a5fa023445b88390a6af0d7e51c90b4d71e02e6c273982efd45f4f2c781fd1608eff5d916968d7c70b06be0b103b33f9

  • SSDEEP

    24576:/iUmSB/o5d1ubcvq/q9JwVZeYc+V8leByGrKzp6B3IjM://mU/ohubcvq/2wVZee8leDrKzp638

  Score

  10^/10

  remcosremotehostcollectioncredential_accessdiscoveryevasionratstealertrojanupx

  • Remcos

    Remcos is a closed-source remote control and surveillance software.

    ratremcos

  • UAC bypass

    evasiontrojan

  • Credentials from Password Stores: Credentials from Web Browsers

    Malicious Access or copy of Web Browser Credential store.

    credential_accessstealer

  • Detected Nirsoft tools

    Free utilities often used by attackers which can steal passwords, product keys, etc.

  • NirSoft MailPassView

    Password recovery tool for various email clients

  • NirSoft WebBrowserPassView

    Password recovery tool for various web browsers

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx

  • Accesses Microsoft Outlook accounts

    collection

  • AutoIT Executable

    AutoIT scripts compiled to PE executables.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2