remcos | 09b930fd43842bf205b6e4182d9044ec9213b0aba4491294080a957b073a5b2f

General

Target
09b930fd43842bf205b6e4182d9044ec9213b0aba4491294080a957b073a5b2f.exe
Size 494KB
Sample250807-nn5j8strt3
SHA256 09b930fd43842bf205b6e4182d9044ec9213b0aba4491294080a957b073a5b2f
MD5 f4064f1d50e72e0b47cdd0342aaca422
SHA1 14b3de4b9133e6e54fe61260ecac67843cb5794e
SHA512 e2b77df32e652d0f61532919189a58f258d4e3d01bbaea5ded10777222ace0cebd446b6bd0e55e229c11455154fa48d2a397aea76f240147eeaff890e45d36a6
SSDEEP 12288:fvVTj8Zv1VG/V+vuwrBazq6vO6iTt+sPZKT:H9ktVqV2Gq6vO6cttZ
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

Malware Config

Extracted

Family

remcos

Version

7.0.1 Pro

C2

angeleviagivenmebestthingsforbetterfeell.duckdns.org:14646

Targets

- Target
  09b930fd43842bf205b6e4182d9044ec9213b0aba4491294080a957b073a5b2f.exe
- Size 494KB
- SHA256 09b930fd43842bf205b6e4182d9044ec9213b0aba4491294080a957b073a5b2f
- MD5 f4064f1d50e72e0b47cdd0342aaca422
- SHA1 14b3de4b9133e6e54fe61260ecac67843cb5794e
- SHA512 e2b77df32e652d0f61532919189a58f258d4e3d01bbaea5ded10777222ace0cebd446b6bd0e55e229c11455154fa48d2a397aea76f240147eeaff890e45d36a6
- SSDEEP 12288:fvVTj8Zv1VG/V+vuwrBazq6vO6iTt+sPZKT:H9ktVqV2Gq6vO6cttZ
- MD5 SHA1 SHA512 SSDEEP
Score

9^/10

collection discovery
- Detected Nirsoft tools
  Free utilities often used by attackers which can steal passwords, product keys, etc.
- NirSoft MailPassView
  Password recovery tool for various email clients
- NirSoft WebBrowserPassView
  Password recovery tool for various web browsers
- Accesses Microsoft Outlook accounts
  collection
- Suspicious use of SetThreadContext
behavioral1 behavioral2

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Email Collection

1

T1114

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Extracted

Targets

Detected Nirsoft tools

NirSoft MailPassView

NirSoft WebBrowserPassView

Accesses Microsoft Outlook accounts

Suspicious use of SetThreadContext

MITRE ATT&CK Enterprise v16

Tasks

static1

behavioral1

behavioral2