Extracted

Extracted

• • Target

    PASUTIJUMU SARAKSTS 2112100 EUR DOKUMENTS SEPTEMBRIS PASUTIJUMA DOC pdf.vbs

  • Size

    502KB

  • MD5

    054770dd0e6f86d42f8df6f72265375b

  • SHA1

    bd012509b749be9acc1dd0a67b8519dedaf1c680

  • SHA256

    0a6ec56a9d84def4f2898df242f92e2aa9cf1bdf0d32bc0b710f4106bc3de651

  • SHA512

    4b2777eb1ff628dfa9f378879828b4d4f4ae19386108de94584683c2173b70e7347da1d55a8be19bf146576e36f3e6ea70c50ab78aed69689ea8ebf2b71ca9c8

  • SSDEEP

    12288:i6tQjLe5sR1aZdlZ7LVSFOzV3JMGeLF8azIdzzEV3J2m2Fjc1AkhbhBs3r:dY2SyPEED

  Score

  10^/10

  discoveryexecutionremcos444collectioncredential_accessratspywarestealer

  • Remcos

    Remcos is a closed-source remote control and surveillance software.

    ratremcos

  • Credentials from Password Stores: Credentials from Web Browsers

    Malicious Access or copy of Web Browser Credential store.

    credential_accessstealer

  • Detected Nirsoft tools

    Free utilities often used by attackers which can steal passwords, product keys, etc.

  • NirSoft MailPassView

    Password recovery tool for various email clients

  • NirSoft WebBrowserPassView

    Password recovery tool for various web browsers

  • Blocklisted process makes network request

  • Command and Scripting Interpreter: PowerShell

    Using powershell.exe command.

    execution

  • Command and Scripting Interpreter: PowerShell

    Run Powershell and hide display window.

    execution

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Drops startup file

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Accesses Microsoft Outlook accounts

    collection

  • Suspicious use of SetThreadContext

  behavioral1behavioral2