Extracted

• • Target

    173766366548204ede648f5b7a7fa4d931df9419dffab5574fd26b7088333bf4a797d053cf821.dat-decoded.exe

  • Size

    234KB

  • MD5

    ff249f4a658f6cfc9ef1444ebc73e94d

  • SHA1

    1542f784b47d815edfdacbe2d431b6752a18e48a

  • SHA256

    fa947c9e00ecaa3c7cbaf13b91a2fce6ba0a356626e75a77fe2a8fbfad38d284

  • SHA512

    343e9ecc755fc1d630878e0c9950ea5a5596f484bc84e0f60035757f82a8525b61e3ed81ec5128d737b67d5017ec2750ac7acf7237f9ab15642ea21c7b250f37

  • SSDEEP

    6144:kP761yOPJaNOKnod5naEtdpB6JdJf7s/ENdcAcrNOr0/RdVVIQ:kP7M0NOK3856JzjsAOZrNlA

  Score

  10^/10

  remcosyoungmoneycollectiondiscoveryratspywarestealerupx

  • Remcos

    Remcos is a closed-source remote control and surveillance software.

    ratremcos

  • Remcos family

    remcos

  • Detected Nirsoft tools

    Free utilities often used by attackers which can steal passwords, product keys, etc.

  • NirSoft MailPassView

    Password recovery tool for various email clients

  • NirSoft WebBrowserPassView

    Password recovery tool for various web browsers

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Accesses Microsoft Outlook accounts

    collection

  • Suspicious use of SetThreadContext

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  behavioral1behavioral2