Extracted

• • Target

    9d64923557fd189c8f045db5f7ebdf23ca6afe0ed48d4b5a9f9398548ef848f8.exe

  • Size

    1.2MB

  • MD5

    71a5c22358684ea0359d9e20c12cbfd0

  • SHA1

    904946890793b72889b04a8d85d7427cbb374ede

  • SHA256

    9d64923557fd189c8f045db5f7ebdf23ca6afe0ed48d4b5a9f9398548ef848f8

  • SHA512

    e5cdfeabc6b857d68df3a3f730ebb998f74e8d528ee90e96965dcb08590350da1e5f5c3f25cc012ce836517b415120038ac728b3c5327c48f101af7f17655dd2

  • SSDEEP

    24576:veZnxqTKr6Suh2q1R+1ixZdZm5efPMM6+D1gH3R:veZaKuEAXd7UM6cUR

  Score

  10^/10

  discoveryexecutionremcoschika dibiacollectionpersistenceratspywarestealer

  • Remcos

    Remcos is a closed-source remote control and surveillance software.

    ratremcos

  • Detected Nirsoft tools

    Free utilities often used by attackers which can steal passwords, product keys, etc.

  • NirSoft MailPassView

    Password recovery tool for various email clients

  • NirSoft WebBrowserPassView

    Password recovery tool for various web browsers

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Accesses Microsoft Outlook accounts

    collection

  • Adds Run key to start application

    persistence

  • Suspicious use of NtCreateThreadExHideFromDebugger

  • Suspicious use of NtSetInformationThreadHideFromDebugger

  • Suspicious use of SetThreadContext

  behavioral1behavioral2