Extracted

• • Target

    2a138508a3f7ad82efdeaaf2fc2e44b8.exe

  • Size

    316KB

  • MD5

    2a138508a3f7ad82efdeaaf2fc2e44b8

  • SHA1

    af000f491f22fb1903f7ade1dad025ced9fa6a54

  • SHA256

    0dd1595e59366de724e13ddb1df995698e62cc62a3b975eee3b0943352d2c1fc

  • SHA512

    616a2aed06756f3ecee8c8ce86f2209d566d73806400ba2842a90204505c2b4bb9f3e56f6d6b23ad45bdd4e62014d43506383c6465a22dd53c41b74afe162c43

  • SSDEEP

    6144:h3hqL36MLuSGP5cBl32nKaGstWs8soSoGhMfA07X52iWKmLrCBZ0O:h3l1ofaGxuoaR0LAdJWj0O

  Score

  10^/10

  guloaderremcosremotehostcollectiondownloaderratspywarestealer

  • Guloader,Cloudeye

    A shellcode based downloader first seen in 2020.

    downloaderguloader

  • Remcos

    Remcos is a closed-source remote control and surveillance software.

    ratremcos

  • NirSoft MailPassView

    Password recovery tool for various email clients

  • NirSoft WebBrowserPassView

    Password recovery tool for various web browsers

  • Nirsoft

  • Loads dropped DLL

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Accesses Microsoft Outlook accounts

    collection

  • Legitimate hosting services abused for malware hosting/C2

  • Suspicious use of NtCreateThreadExHideFromDebugger

  • Suspicious use of NtSetInformationThreadHideFromDebugger

  • Suspicious use of SetThreadContext

  behavioral1behavioral2