Extracted

• • Target

    4e5eeb3466f9ff1b02cf89480335e8d746ca6ecaeb658dd43f08eed3ea877c39.bat

  • Size

    6.7MB

  • MD5

    a3508267d7a36e0823f98f3b0c8be53e

  • SHA1

    ad616497393aa64cc82090ff565111531f54921c

  • SHA256

    4e5eeb3466f9ff1b02cf89480335e8d746ca6ecaeb658dd43f08eed3ea877c39

  • SHA512

    a85aea224a0369eedc247fb7ec21f8f50af1dce4ee814196b23e884aa8ca4e0c5358469900eb806bcd0fc59c85a5ad9f03d93f8a3e73320a0b66264cbc4d1d7c

  • SSDEEP

    49152:90Gy6Q/liR7e23oSl2ZKxubTjJvrHEXzUP93pSVVNjrZD07DJZhNzU00UcBuoitX:O

  Score

  10^/10

  modiloaderremcosremotehostcollectionpersistencerattrojan

  • ModiLoader, DBatLoader

    ModiLoader is a Delphi loader that misuses cloud services to download other malicious families.

    trojanmodiloader

  • Remcos

    Remcos is a closed-source remote control and surveillance software.

    ratremcos

  • Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003)

  • Detects executables built or packed with MPress PE compressor

  • Detects executables referencing many confidential data stores found in browsers, mail clients, cryptocurreny wallets, etc. Observed in information stealers

  • Detects executables referencing many email and collaboration clients. Observed in information stealers

  • ModiLoader Second Stage

  • NirSoft MailPassView

    Password recovery tool for various email clients

  • NirSoft WebBrowserPassView

    Password recovery tool for various web browsers

  • Nirsoft

  • Creates new service(s)

    persistence

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Accesses Microsoft Outlook accounts

    collection

  • Adds Run key to start application

    persistence

  • Suspicious use of SetThreadContext

  behavioral1behavioral2