General
-
Target
d9465ad29caa66ba9d539f9b59a4d058147bf13d284e6289fc7b6ef3b9a4bb1b
-
Size
1.2MB
-
Sample
220521-xb7nhaefgr
-
MD5
7150336413ac578fda576f4e525b2c7e
-
SHA1
f0e14ca24609764e5e77ef3cd66415bb276f6441
-
SHA256
d9465ad29caa66ba9d539f9b59a4d058147bf13d284e6289fc7b6ef3b9a4bb1b
-
SHA512
7f93f5737151984da5353d8c0a19d0d3772e2aaf7981e990a907b081cdaf30dd2db6010d24d7343a3cb4e9e733ae0b49f35de88bcb940ca2e4db8904f78a73ec
Static task
static1
Behavioral task
behavioral1
Sample
REMITTAN.exe
Resource
win7-20220414-en
Behavioral task
behavioral2
Sample
REMITTAN.exe
Resource
win10v2004-20220414-en
Malware Config
Extracted
guloader
https://twadatabase.com/uj/newsamcav_HgMSY69.bin
Targets
-
-
Target
REMITTAN.EXE
-
Size
104KB
-
MD5
a5227202babf335d14eec4a0a497f62c
-
SHA1
b1ccb23abcaf2271167b9e7534e40512d8a36723
-
SHA256
e761de2471fe1811d6a545231c1aa3d6b8065f0157af871808d2443c8c61dd09
-
SHA512
b46ed3cbc786d997153be17ed7e1df5f08ed5525a09d7b824ff94dd4cca20c98ce7d015fb09ff2bca18bfeff81c3502fb4d6ba18714e5cc76b34e05cc98a16c1
Score10/10-
Guloader Payload
-
Checks QEMU agent state file
Checks state file used by QEMU agent, possibly to detect virtualization.
-
Adds Run key to start application
-
Suspicious use of NtSetInformationThreadHideFromDebugger
-
Suspicious use of SetThreadContext
-