Extracted

Extracted

• • Target

    0x000300000000b3e3-94

  • Size

    194KB

  • MD5

    914253e6225b686ee3e0a752c1cd1bb4

  • SHA1

    42e9ae719f4dfd04e7dcb9d58a911eb37fd3439c

  • SHA256

    00f52a2f56551d868397acd11e4d12c353d7107ce680c6ff00012a90dabc818b

  • SHA512

    92ecf4249ef488d95a657a3e920316cc816e2e8d5d2b8e257e4ce074626beda95d379034c86758ac7a1623354cfe2cba14bf811f73f3a35fe97e3610d85c9e3b

  • SSDEEP

    3072:7tduXlp2G4E2A0w8Vf0DyQPrWDgt5pUGw1piL71OkHiMZzvcqgp3yO9pj2t7tK:JW2Gp9b8tPQPacR9vctpiO9pjGtK

  Score

  10^/10

  executionremcosremotehostcollectioncredential_accessdiscoveryratspywarestealer

  • Remcos

    Remcos is a closed-source remote control and surveillance software.

    ratremcos

  • Credentials from Password Stores: Credentials from Web Browsers

    Malicious Access or copy of Web Browser Credential store.

    credential_accessstealer

  • Detected Nirsoft tools

    Free utilities often used by attackers which can steal passwords, product keys, etc.

  • NirSoft MailPassView

    Password recovery tool for various email clients

  • NirSoft WebBrowserPassView

    Password recovery tool for various web browsers

  • Blocklisted process makes network request

  • Command and Scripting Interpreter: PowerShell

    Run Powershell and hide display window.

    execution

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Accesses Microsoft Outlook accounts

    collection

  • Suspicious use of SetThreadContext

  behavioral1behavioral2