Extracted

• • Target

    79b1315cab839553008486cf182981ce0a36c1755a83e37f7b107cdb7266f0cb.exe

  • Size

    925KB

  • MD5

    0e9e305e1e69c435383eb73f66c63530

  • SHA1

    9d5eb75968bfe5a1e12af2d81f8b20322c77f2ec

  • SHA256

    79b1315cab839553008486cf182981ce0a36c1755a83e37f7b107cdb7266f0cb

  • SHA512

    1bdd88fab52efebbc81ce27b961f7a574ca6e4a9216570bf5193ff09c8f9f8771b93e0a4a312f61a208ecfec2f97b7027fa99dce35b5772d7d99a2a65ad5645e

  • SSDEEP

    24576:Ibo2IFemqKLdQ+tExSVoVKbcqmuDaomTzktr:Ic2tlKLzsAqAhtSgt

  Score

  10^/10

  remcosremotehostcollectioncredential_accessdiscoverypersistenceratspywarestealer

  • Remcos

    Remcos is a closed-source remote control and surveillance software.

    ratremcos

  • Credentials from Password Stores: Credentials from Web Browsers

    Malicious Access or copy of Web Browser Credential store.

    credential_accessstealer

  • Detected Nirsoft tools

    Free utilities often used by attackers which can steal passwords, product keys, etc.

  • NirSoft MailPassView

    Password recovery tool for various email clients

  • NirSoft WebBrowserPassView

    Password recovery tool for various web browsers

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Accesses Microsoft Outlook accounts

    collection

  • Adds Run key to start application

    persistence

  • Suspicious use of SetThreadContext

  behavioral1behavioral2