Extracted

• • Target

    8f1116313dec5e9eb3ac4953962a15c7.exe

  • Size

    1.3MB

  • MD5

    8f1116313dec5e9eb3ac4953962a15c7

  • SHA1

    7d46a96f3d3f47522b8e758403c8bc536895dbf6

  • SHA256

    3a5642db8fa61e0866654077342c06ed1b077af52736cbc77793311daeb4ba57

  • SHA512

    86a50b867d4b7790ab7feca6faa0ae7ef53ddf8cca333624e0f1c1f60c5c52006a2ec85667cc728686f82a4fd60e47c5627a88c1241006748ce77d15de3830a0

  • SSDEEP

    24576:Z6U/0zosBBUC/UjadgzQdbzyoxSyz74WCePDMoqno2NND74lamB:ZF2GC/yApoy/p3PDP6Elaa

  Score

  10^/10

  remcosremotehostcollectiondiscoveryratspywarestealer

  • Remcos

    Remcos is a closed-source remote control and surveillance software.

    ratremcos

  • Remcos family

    remcos

  • Detected Nirsoft tools

    Free utilities often used by attackers which can steal passwords, product keys, etc.

  • NirSoft MailPassView

    Password recovery tool for various email clients

  • NirSoft WebBrowserPassView

    Password recovery tool for various web browsers

  • Loads dropped DLL

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Accesses Microsoft Outlook accounts

    collection

  • Suspicious use of NtCreateThreadExHideFromDebugger

  • Suspicious use of NtSetInformationThreadHideFromDebugger

  • Suspicious use of SetThreadContext

  behavioral1behavioral2

• • Target

    $PLUGINSDIR/System.dll

  • Size

    11KB

  • MD5

    fc3772787eb239ef4d0399680dcc4343

  • SHA1

    db2fa99ec967178cd8057a14a428a8439a961a73

  • SHA256

    9b93c61c9d63ef8ec80892cc0e4a0877966dca9b0c3eb85555cebd2ddf4d6eed

  • SHA512

    79e491ca4591a5da70116114b7fbb66ee15a0532386035e980c9dfe7afb59b1f9d9c758891e25bfb45c36b07afd3e171bac37a86c887387ef0e80b1eaf296c89

  • SSDEEP

    192:eS24sihno00Wfl97nH6T2enXwWobpWBTU4VtHT7dmN35OloSl:S8QIl975eXqlWBrz7YLOlo

  Score

  3^/10

  discovery
  behavioral3behavioral4