Extracted

• • Target
    9f2830a19edaacf690e6626e58b201d747a5a510777e5e92acf42a4efd28ddb6.exe
  • Size 577KB
  • SHA256 9f2830a19edaacf690e6626e58b201d747a5a510777e5e92acf42a4efd28ddb6
  • MD5 02afc0eb91235f176b47b0ed15f67400
  • SHA1 9c8acd9adc953a945289009712cb089ce58a3ed0
  • SHA512 bdfb8bdaf58df9a5f280e98c73778c61bc0f88c27b44eb5d2a510382e5b76bd902ecc5664363a38b96871e897f3c7cb045d85ed6157f762a7dba37e86175bce4
  • SSDEEP 12288:bi9a8F9k3rDCkCQ6mAuy5+IQUoCmGJZxGZVmn4yCa:R8F9cvbX6QGtGZEnf
  • MD5 SHA1 SHA512 SSDEEP

  Score

  10^/10

  remcosremotehostcollectionratspywarestealer

  • Remcos

    Remcos is a closed-source remote control and surveillance software.

    ratremcos

  • Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003)

  • Detects executables built or packed with MPress PE compressor

  • Detects executables referencing many confidential data stores found in browsers, mail clients, cryptocurreny wallets, etc. Observed in information stealers

  • Detects executables referencing many email and collaboration clients. Observed in information stealers

  • NirSoft MailPassView

    Password recovery tool for various email clients

  • NirSoft WebBrowserPassView

    Password recovery tool for various web browsers

  • Nirsoft

  • Executes dropped EXE

  • Loads dropped DLL

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Accesses Microsoft Outlook accounts

    collection

  • Drops file in System32 directory

  • Suspicious use of NtCreateThreadExHideFromDebugger

  • Suspicious use of NtSetInformationThreadHideFromDebugger

  • Suspicious use of SetThreadContext

  behavioral1behavioral2
• • Target
    $PLUGINSDIR/nsExec.dll
  • Size 6KB
  • SHA256 030bcfa82e3bb424835a5fa53a3ff17ab08557d3bbeea4815313036fc4bdafe1
  • MD5 14f5984b926208de2aafb55dd9971d4a
  • SHA1 e5afe0b80568135d3e259c73f93947d758a7b980
  • SHA512 e9ec97dd57ead871789d49ed38d9fde5f31d3cb2547810cae49a736e06b9f9b28cf8efea825eb83c3e07d880ee798abfb9069c6957416d5973c83e4531814e27
  • SSDEEP 96:k7GUaYNwCLuGFctpiKFlYJ8hH4RVHpwdEeY3kRlDr6dMqqyVgNJ38:Wygp3FcHi0xhYMR8dMqJVgN
  • MD5 SHA1 SHA512 SSDEEP

  Score

  3^/10
  behavioral3behavioral4
• • Target
    Seychelliske/brandbar/Choktilstandens.Max
  • Size 55KB
  • SHA256 ef2884aa50d62da1aae7a8822741cfe349d6a2fbead3af48698b5a75f0984842
  • MD5 24331b1a54b51979a5d15264c3e8ce92
  • SHA1 b59076231f0c495f0588d8aa5c9c2af74428a23d
  • SHA512 5a909fe7b46c97b16e99b979de89f7ba3986b96f6e20daef0cb89f39a7e8b4dd2e3829de91f06ef2900d1b5021d23c80407bb41903cac1700dc1690d52738616
  • SSDEEP 768:3anLEjThLL+4z+2ImC+8OCJirt+IDxIFdP/I6zmhQo6O8NbvQpCCwifW1IAxpwU:3aLEnh5c+o2tTVIw6zpBO8NspLf0L
  • MD5 SHA1 SHA512 SSDEEP

  Score

  8^/10

  persistence

  • Modifies Installed Components in the registry

    persistence

  • Enumerates connected drives

    Attempts to read the root path of hard drives other than the default C: drive.

  behavioral5behavioral6