Extracted

Extracted

• • Target

    C_UsersAdministratorDesktopWernbvFILE_DOC_SSLMUNSRG0014624.js

  • Size

    600KB

  • MD5

    2b1f137f22ac559ec305ce5cfa8890b4

  • SHA1

    78eea4d0412efdce79ecd7bd36381d9fcec3b07c

  • SHA256

    87a46f9efd26fa0b9182f12ee89ef19975fab1927d056629142608f27cc5f4b1

  • SHA512

    d772cf3cda1ac8368992d21217cd6c866a5554bc3f4e9ee728709c03d72e402f8bfcd5a21afc6e58dbcdba4090b0f9970b7adab857b1b6d85d123c24a616383c

  • SSDEEP

    12288:W8hhuwMaJTTfrjTsfY51YkMLrl5sDdNZftj0Ue6BzNv2kSw0OORbrHy3JTpgxRmX:BhJKIzFt4nR6jX5n

  Score

  10^/10

  remcospc filecollectioncredential_accessdiscoveryexecutionpersistenceratstealer

  • Remcos

    Remcos is a closed-source remote control and surveillance software.

    ratremcos

  • Credentials from Password Stores: Credentials from Web Browsers

    Malicious Access or copy of Web Browser Credential store.

    credential_accessstealer

  • Detected Nirsoft tools

    Free utilities often used by attackers which can steal passwords, product keys, etc.

  • NirSoft MailPassView

    Password recovery tool for various email clients

  • NirSoft WebBrowserPassView

    Password recovery tool for various web browsers

  • Blocklisted process makes network request

  • Command and Scripting Interpreter: PowerShell

    Run Powershell and hide display window.

    execution

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Accesses Microsoft Outlook accounts

    collection

  • Adds Run key to start application

    persistence

  • Suspicious use of SetThreadContext

  behavioral1behavioral2