Extracted

• • Target
    goodthingsarecomingfromtheehartforme.hta
  • Size 13KB
  • SHA256 91cb65afeec2d670e34e94e1db63b3196609e3e6cd81d9ba77d37930fbc293d2
  • MD5 a4b32ec3a8b314893a5303b9686b907a
  • SHA1 4233b2802bc1437a33cee452a806b5c5a6189b24
  • SHA512 3bd0857e1761e7032594d2ee92ddabdd58bc16317d26c6e9bdd25f4baefdac52692c1db7e0e33f4f47a9a2720587eb820a1348d8b0d7c286206faa3ac767812d
  • SSDEEP 48:3OVqjaEBVqjaZYgXouuuuuIa2giuuu0ouuuuuu1uukVqjNVqjR5+VqjaaPG:eYjvYjAW/YjNYjRsYj5+
  • TLSH
    T18352BC3CBAB0FAA5D1FF62FC0905B85615969D3B8930AD053CCC8297C74167A6D4E28F
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  discoveryexecutionrem01collectioncredential_accessremcosratspywarestealer

  • Family: Remcos

    Remcos is a closed-source remote control and surveillance software.

    ratremcos

  • Badlisted process makes network request

    Network request originating from process or tool commonly abused by malware.

  • Downloads MZ/PE file

  • Uses browser remote debugging

    Can be used control the browser and steal sensitive information such as credentials and session cookies.

    credential_accessstealer

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Accesses Microsoft Outlook profiles

    collection

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery

  • Suspicious use of NtSetInformationThreadHideFromDebugger

  • Suspicious use of SetThreadContext

  behavioral1behavioral2