Extracted

• • Target

    file.exe

  • Size

    574KB

  • MD5

    69bf840d279bb17e387e74914a122af6

  • SHA1

    7c5e6a9c7107ed3ef251d5571ef2dd053165ec8d

  • SHA256

    343b2ad0290badf5ce4700a3b93866f63ef8157b157f09cb3c9da4f3efd1c1c2

  • SHA512

    6d374c7b929b3f52b1723e0a13e316a0d51e6fee43e949a3453b77b1d7a7e11018a5ae279996c004fa26f161115c331a96f0a1ef01725aa847ce292d18792d84

  • SSDEEP

    12288:V0obxAhh3kCS/ylnAjQSLhBPlyF1+SULR2NpT5R:hlAoiFSnlyFk1LR8pT5R

  Score

  10^/10

  guloaderdownloaderremcossammmmmcollectionpersistenceratspywarestealer

  • Guloader,Cloudeye

    A shellcode based downloader first seen in 2020.

    downloaderguloader

  • Remcos

    Remcos is a closed-source remote control and surveillance software.

    ratremcos

  • NirSoft MailPassView

    Password recovery tool for various email clients

  • NirSoft WebBrowserPassView

    Password recovery tool for various web browsers

  • Nirsoft

  • Checks QEMU agent file

    Checks presence of QEMU agent, possibly to detect virtualization.

  • Loads dropped DLL

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Accesses Microsoft Outlook accounts

    collection

  • Adds Run key to start application

    persistence

  • Legitimate hosting services abused for malware hosting/C2

  • Suspicious use of NtCreateThreadExHideFromDebugger

  • Suspicious use of NtSetInformationThreadHideFromDebugger

  • Suspicious use of SetThreadContext

  behavioral1behavioral2