Extracted

• • Target
    SecuriteInfo.com.Win32.PWSX-gen.24212.14364.exe
  • Size 919KB
  • SHA256 36609ed28222d995170a36e1d4df63fcf518bece4a965e5674cc5a03c2d2b324
  • MD5 e433558ced9cd543207bd7bc7da5b361
  • SHA1 3db2833a506acf05d379b603e54d7e7bf9facd5f
  • SHA512 0dbe901e0d78b7e0e6b7675eefba3af267730a53b9bf7f9c89804dd41ee84504b216f966bcfea3ed0a6fc61ff5ab01ba09773700fa0f806067a277d1f57b4368
  • SSDEEP 24576:oVMCt5BT8pwLmRa8wN/2Gc7dOxFF3VTNrRjdCq:iMCtowDXBcBOTJRNRdh
  • MD5 SHA1 SHA512 SSDEEP

  Score

  10^/10

  remcosyenomcollectioncredential_accessdiscoveryexecutionratstealer

  • Remcos

    Remcos is a closed-source remote control and surveillance software.

    ratremcos

  • Credentials from Password Stores: Credentials from Web Browsers

    Malicious Access or copy of Web Browser Credential store.

    credential_accessstealer

  • Detected Nirsoft tools

    Free utilities often used by attackers which can steal passwords, product keys, etc.

  • NirSoft MailPassView

    Password recovery tool for various email clients

  • NirSoft WebBrowserPassView

    Password recovery tool for various web browsers

  • Command and Scripting Interpreter: PowerShell

    Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

    execution

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Uses the VBS compiler for execution

  • Accesses Microsoft Outlook accounts

    collection

  • Suspicious use of SetThreadContext

  behavioral1behavioral2