Extracted

Extracted

• • Target
    aa00054329f9fd7e6bad58734b991d1e2b87a316a14bee261664f30cdaaaec35.bin
  • Size 265KB
  • SHA256 aa00054329f9fd7e6bad58734b991d1e2b87a316a14bee261664f30cdaaaec35
  • MD5 aa612b2743408c41a76a608a2c88b3fd
  • SHA1 8c1400b7366419a1ae0db94e4a857de3f3cb7a7b
  • SHA512 0e7633c330080e6836be94f8f6341b58c7812cd7bb4380fd6ef5220ce2ad54ba3b20d19ae6a1859aa6ecd259fb6e4e59840e0273bf7355ea35174aa8e0e80ed9
  • SSDEEP 192:bxFGmhtPkvyzDNjSls3iZ69gzFGmhtRLSls3iZ2iqjEZRZLSls3iZqSenOyLeH80:bpFgUglEgmgjrvoOgBc4qqm+NGJ
  • TLSH
    T16B4463CC8E8B01A546D12E5736E38359AE03D87D4CCA6B73D0E67AC2F9A06C93319D75
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  log_septcollectioncredential_accessdiscoveryexecutionremcosratstealer

  • Family: Remcos

    Remcos is a closed-source remote control and surveillance software.

    ratremcos

  • Process spawned unexpected child process

    This typically indicates the parent process was compromised via an exploit or macro.

  • Badlisted process makes network request

    Network request originating from process or tool commonly abused by malware.

  • Uses browser remote debugging

    Can be used to control the browser and steal sensitive information such as credentials and session cookies.

    credential_accessstealer

  • Loads dropped DLL

  • Accesses Microsoft Outlook profiles

    collection

  • Command and Scripting Interpreter: PowerShell

    Using powershell.exe command.

    execution

  • Executes a VBScript file via the Windows Script Host.

    execution

  • Suspicious use of SetThreadContext

  behavioral1behavioral2