Extracted

• • Target

    QuoteQu11262024.scr.exe

  • Size

    820KB

  • MD5

    a75036f188683604d03dd8f03fee6ec3

  • SHA1

    cc2c07398c85ffcd033223d01155851647d0ee68

  • SHA256

    4c1df01c44c5a69f9efa30528117c3d90f2df8a78c23a7ccc25412da15793531

  • SHA512

    2a32707969a776c20150ab79b62204918ad6a96599acc99c7d6e99ce1c43eadb77fdf79c0dc59eb517005ab16d6aaa28ab229e68d20bf087ec82a957837390e1

  • SSDEEP

    12288:7b0EifOJq8Ikm2qv1GV8gmxJziOoA3TB98/0v7Z0Q9i4xw3u5IDkd72gGmkRJWk6:7bxgGKLz8G/XBO/0vOAi4xwk9VS6n

  Score

  10^/10

  discoveryremcosremotehostcollectionpersistenceratspywarestealer

  • Remcos

    Remcos is a closed-source remote control and surveillance software.

    ratremcos

  • Remcos family

    remcos

  • Detected Nirsoft tools

    Free utilities often used by attackers which can steal passwords, product keys, etc.

  • NirSoft MailPassView

    Password recovery tool for various email clients

  • NirSoft WebBrowserPassView

    Password recovery tool for various web browsers

  • Loads dropped DLL

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Accesses Microsoft Outlook accounts

    collection

  • Adds Run key to start application

    persistence

  • Suspicious use of NtCreateThreadExHideFromDebugger

  • Suspicious use of NtSetInformationThreadHideFromDebugger

  • Suspicious use of SetThreadContext

  behavioral1behavioral2

• • Target

    $PLUGINSDIR/System.dll

  • Size

    11KB

  • MD5

    b0c77267f13b2f87c084fd86ef51ccfc

  • SHA1

    f7543f9e9b4f04386dfbf33c38cbed1bf205afb3

  • SHA256

    a0cac4cf4852895619bc7743ebeb89f9e4927ccdb9e66b1bcd92a4136d0f9c77

  • SHA512

    f2b57a2eea00f52a3c7080f4b5f2bb85a7a9b9f16d12da8f8ff673824556c62a0f742b72be0fd82a2612a4b6dbd7e0fdc27065212da703c2f7e28d199696f66e

  • SSDEEP

    192:4PtkiQJr7jHYT87RfwXQ6YSYtOuVDi7IsFW14Ll8CO:H78TQIgGCDp14LGC

  Score

  3^/10

  discovery
  behavioral3behavioral4