Extracted

• • Target

    French Group.js

  • Size

    6KB

  • MD5

    71cd7220e91d8c3d271876af2af2aaad

  • SHA1

    6bd5624079271676ab36f3a28ea227ed8f6b8117

  • SHA256

    7d894786f3d675adfdebe8f6b17bf3f580e55276a2b1239b7e46412350f7ca4d

  • SHA512

    dfb89b71d3e3a23cc7b977ae375e4513b8001d62759dcafb62d267f5ad764061c9bb873539b3750f257674583e5b9e0294be5a5a7eace61e1bf60f203345327f

  • SSDEEP

    96:X2mMYzgttgVfDQFJKV0Zs/vU2y35HkHPVHKTonl7ie:hifwUt3u7j

  Score

  10^/10

  executionremcosngwucollectioncredential_accessdiscoveryratspywarestealer

  • Remcos

    Remcos is a closed-source remote control and surveillance software.

    ratremcos

  • Credentials from Password Stores: Credentials from Web Browsers

    Malicious Access or copy of Web Browser Credential store.

    credential_accessstealer

  • Detected Nirsoft tools

    Free utilities often used by attackers which can steal passwords, product keys, etc.

  • NirSoft MailPassView

    Password recovery tool for various email clients

  • NirSoft WebBrowserPassView

    Password recovery tool for various web browsers

  • Blocklisted process makes network request

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Drops startup file

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Accesses Microsoft Outlook accounts

    collection

  • Command and Scripting Interpreter: PowerShell

    Using powershell.exe command.

    execution

  • Legitimate hosting services abused for malware hosting/C2

  • Suspicious use of SetThreadContext

  behavioral1behavioral2