Extracted

• • Target
    Narudžba 26-0204-001033190180_PDF.js
  • Size 2.2MB
  • SHA256 48974f4176b42b3fa40793832b176f90516c9468d1ef5b67747307b1cd1cca3f
  • MD5 cf0a4dd9aaded971bcaab8a22350a94a
  • SHA1 c0729a8013e72d506609f698a2b54d8c0f47c64c
  • SHA512 a5990deca44739d3a1f02fc8f025dadb8ae62a24299876ce0faed6bd04da76719d598dc9996f1b1b3a9155eaff34dd284a819af390ac56a67e82d96efca6dbb2
  • SSDEEP 192:Ztttttttttttttttttttttttttttttttttttttttttttttttttttttttttttttti:SaeiLSGmJuU
  • TLSH
    T197B5E896D6D7263D7F81B50BFD755A8FCE08D0A11E2A3E9C942F47B500D2ACE8D70A18
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  executionjide001collectiondiscoveryremcosratspywarestealer

  • Family: Remcos

    Remcos is a closed-source remote control and surveillance software.

    ratremcos

  • Process spawned unexpected child process

    This typically indicates the parent process was compromised via an exploit or macro.

  • Detected Nirsoft tools

    Free utilities often used by attackers which can steal passwords, product keys, etc.

  • NirSoft MailPassView

    Password recovery tool for various email clients

  • NirSoft WebBrowserPassView

    Password recovery tool for various web browsers

  • Badlisted process makes network request

    Network request originating from process or tool commonly abused by malware.

  • Command and Scripting Interpreter: PowerShell

    Run Powershell and hide display window.

    execution

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Accesses Microsoft Outlook accounts

    collection

  • Suspicious use of SetThreadContext

  behavioral1behavioral2