Extracted

• • Target

    Purchase Order Draft for ATPS Inq Ref240912887-ATPS.exe

  • Size

    760KB

  • MD5

    20d75709d275ee9fc5b559e50ae667c3

  • SHA1

    27b41abb5cf6a0492fbd44db949ed78629548ee6

  • SHA256

    530d877fd245da9636806e92b1b3271ccbdb89c4e08e534171469b70f2f7dc7a

  • SHA512

    0987ce0ae8d3447034f76b11ab618b8b92f73d0e5ed50d2e5a0ba204f0a8cf830ed4795abbeebe72c035ecfa3e96391756cda8cb7f064f183cdb4554510be64f

  • SSDEEP

    12288:GtomEHbPc17d211S7nu/s6dSf/5vJ6UuWsz6MNwXLLKqKUGpjSvI0Z:TN7Pi7Iw1aSz6n16ewXLu9UKjSvI0Z

  Score

  10^/10

  remcosremotehostcollectiondiscoveryratspywarestealer

  • Remcos

    Remcos is a closed-source remote control and surveillance software.

    ratremcos

  • Remcos family

    remcos

  • Detected Nirsoft tools

    Free utilities often used by attackers which can steal passwords, product keys, etc.

  • NirSoft MailPassView

    Password recovery tool for various email clients

  • NirSoft WebBrowserPassView

    Password recovery tool for various web browsers

  • Loads dropped DLL

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Accesses Microsoft Outlook accounts

    collection

  • Suspicious use of NtCreateThreadExHideFromDebugger

  • Suspicious use of NtSetInformationThreadHideFromDebugger

  • Suspicious use of SetThreadContext

  behavioral1behavioral2

• • Target

    $PLUGINSDIR/System.dll

  • Size

    11KB

  • MD5

    ca332bb753b0775d5e806e236ddcec55

  • SHA1

    f35ef76592f20850baef2ebbd3c9a2cfb5ad8d8f

  • SHA256

    df5ae79fa558dc7af244ec6e53939563b966e7dbd8867e114e928678dbd56e5d

  • SHA512

    2de0956a1ad58ad7086e427e89b819089f2a7f1e4133ed2a0a736adc0614e8588ebe2d97f1b59ab8886d662aeb40e0b4838c6a65fbfc652253e3a45664a03a00

  • SSDEEP

    192:eo24sihno00Wfl97nH6T2enXwWobpWBTU4VtHT7dmN35Ol6Sl:k8QIl975eXqlWBrz7YLOl6

  Score

  3^/10

  discovery
  behavioral3behavioral4