Extracted

• • Target
    2421PENDIENTES092021/2421PENDIENTES092021/2421PENDIENTES092021-031.exe
  • Size 486KB
  • SHA256 aada2c96c64d5d7a5cc98b71e0f8828b89bc6a3e44be7ffa041956115836b785
  • MD5 266f4731cdbb2d9bc2da47265587a300
  • SHA1 e72b57aadde7c0196398583fb1d79d5f1a0009f1
  • SHA512 a01a9f26610bca57f41f2e17a31acbbab26b799a63ca29866ecf200354e7e4d915229f00e4cba4ebb978e4d94a36783ea0b119260b11410727f2d600892b5492
  • MD5 SHA1 SHA512

  Score

  7^/10

  • Loads dropped DLL

  • Suspicious use of SetThreadContext

  behavioral1
• • Target
    2421PENDIENTES092021/2421PENDIENTES092021/2421PENDIENTES092021-032.exe
  • Size 271KB
  • SHA256 32af8708ab49a4c7f58772d988760f0481b4d93d88e42e5dd76dd0e4c5a3b321
  • MD5 cb14cc1f8e5925c4c4eb078f73f79509
  • SHA1 44dde5f60ef61b2829fe19b62ffab5b759882773
  • SHA512 908048ea3b9d0708f5cfa11f41e5e4d628aa8edb67744029c0a182430e7baa98ad6bfb816dd9e12d307b44ea2f6d82deee31c3402f57ad4cc17563c972fd958a
  • MD5 SHA1 SHA512

  Score

  10^/10

  remcospersistenceratupx

  • Remcos

    Remcos is a closed-source remote control and surveillance software.

    ratremcos

  • Executes dropped EXE

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx

  • Deletes itself

  • Loads dropped DLL

  • Adds Run key to start application

    persistence

  • Suspicious use of SetThreadContext

  behavioral2
• • Target
    2421PENDIENTES092021/2421PENDIENTES092021/2421PENDIENTES092021-034.exe
  • Size 320KB
  • SHA256 e2b899baa7500884e7dbe9219f641996f11ed287b17abcce04764815d64895ae
  • MD5 10808bd39b8950f2518537a6094f24f3
  • SHA1 f95be25353f78dd7ba8acee83011fa8da81deaaa
  • SHA512 adb0ca44f25fad226258d5f0480fbb31c80cf5918337bd60651079bfdecf1329c0d25757ef6bcf582b1f8c4cb2dc35d99a66754f4e5443817e60f8954c68e97f
  • MD5 SHA1 SHA512

  Score

  10^/10

  snakekeyloggerkeyloggerspywarestealer

  • Snake Keylogger

    Keylogger and Infostealer first seen in November 2020.

    stealerkeyloggersnakekeylogger

  • Loads dropped DLL

  • Reads data files stored by FTP clients

    Tries to access configuration files associated with programs like FileZilla.

    spywarestealer

  • Reads user/profile data of local email clients

    Email clients store some user data on disk where infostealers will often target it.

    spywarestealer

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Suspicious use of SetThreadContext

  behavioral3