Extracted

Extracted

• • Target

    seethepictureofniceworkingherethis.tIF

  • Size

    196KB

  • MD5

    6e4907908c89e0ccf170839aca173008

  • SHA1

    e192fa4ccee7bb86434f3e2c6504da3eb5b8d6ad

  • SHA256

    eb0d4a83d4e4f3ef9e1e87ab853b71a007f8d604eeb94cb76fecde0ec6eae0ca

  • SHA512

    a4924381716d9a6a7b9f08e3e0944a71a4d12b52392fdea5b1021fedc915ee3cf8330c768703dd4a61bb5ec6ea1024e44440f92702d7cfb152a8feb00b6dace2

  • SSDEEP

    3072:MwXK47Z/aCMMHUqDT4apeAT63vuWtBoF/0ljSXEGrw4a8z/zqkTYzQ100eCN8j62:MWO5UAWO07NmduzTSDMO2MgAf+37+

  Score

  10^/10

  executionremcoszynovacollectioncredential_accessdiscoveryratspywarestealer

  • Remcos

    Remcos is a closed-source remote control and surveillance software.

    ratremcos

  • Credentials from Password Stores: Credentials from Web Browsers

    Malicious Access or copy of Web Browser Credential store.

    credential_accessstealer

  • Detected Nirsoft tools

    Free utilities often used by attackers which can steal passwords, product keys, etc.

  • NirSoft MailPassView

    Password recovery tool for various email clients

  • NirSoft WebBrowserPassView

    Password recovery tool for various web browsers

  • Blocklisted process makes network request

  • Command and Scripting Interpreter: PowerShell

    Run Powershell and hide display window.

    execution

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Accesses Microsoft Outlook accounts

    collection

  • Suspicious use of SetThreadContext

  behavioral1behavioral2