Extracted

• • Target
    e361e0ed13887b948809b6a88bc3464d648cac54e73aa431a1c8e3751e268554
  • Size 481KB
  • SHA256 e361e0ed13887b948809b6a88bc3464d648cac54e73aa431a1c8e3751e268554
  • MD5 899e1f862a9b39d5f0622011f7512dcb
  • SHA1 daf0e2f3c8bf3178adc3ee247cbd31be4a023667
  • SHA512 fde3651affbbaa73d431cfdbc12fd5ccc245da3d075a0520d7d7e1c99700ac0a37f6fab9699ce4e15646f245d829ad50a3c901aca9eb8bc9a3a635dce5d518c1
  • SSDEEP 12288:f13ak/mBXTG4/1v08KI7ZnMEF76JqmsvZQZS:Nak/mBXTV/R0nEF76gFZO
  • TLSH
    T176A4BF01BAD2C072D57654300C3AE775DEBDBD212839897BB3D61D97FD30190A63AAB2
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  exploit aug-10--2026collectiondiscoveryremcosratspywarestealersuricata

  • Family: Remcos

    Remcos is a closed-source remote control and surveillance software.

    ratremcos

  • Suricata alert: REMCOS RAT Malware Inbound C2 Communication

    Network activity triggered a Suricata alert

    suricataremcos

  • Suricata alert: REMCOS RAT Malware Outbound C2 Communication

    Network activity triggered a Suricata alert

    suricataremcos

  • Detected Nirsoft tools

    Free utilities often used by attackers which can steal passwords, product keys, etc.

  • NirSoft MailPassView

    Password recovery tool for various email clients

  • NirSoft WebBrowserPassView

    Password recovery tool for various web browsers

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Accesses Microsoft Outlook accounts

    collection

  • Accesses Microsoft Outlook profiles

    collection

  • Suspicious use of SetThreadContext

  behavioral1behavioral2