Overview

overview

10

Static

static

10

59c861a26a...378.js

windows7-x64

10

59c861a26a...378.js

windows10-2004-x64

10

deobfuscated.js

windows7-x64

10

deobfuscated.js

windows10-2004-x64

10

payload/payload.ps1

windows7-x64

8

payload/payload.ps1

windows10-2004-x64

8

payload/pa...l.html

windows7-x64

1

payload/pa...l.html

windows10-2004-x64

1

payload/pa...ad.dll

windows7-x64

1

payload/pa...ad.dll

windows10-2004-x64

1

Sharing

Copy URL Twitter E-mail

General

  • Target

    REMCOS-59c861a26a84d17beb487803322d60ec30260556d20d550ac309bc85851eb378.rar

  • Size

    15KB

  • MD5

    854f06916282c2274e9f76ede01050d1

  • SHA1

    9a31cfc18ad490e56c6889051c55305fece37a65

  • SHA256

    8d4dc1660173a936930fb215f698da0456c216e7fdb32e55ddc808ec9e46acd6

  • SHA512

    912222cfac29de5b4ff1c4fd22a9b7947c72537f23117d97e2d84bedf3db5d1d0f17987f604ee59b8a6b343f8b1c8c0a50597ca34eafac9f0d926194036f0113

  • SSDEEP

    384:kTJhHKxwIna8iiptGQdaAASPKsrHgJIPJ+pAsu2PzC9/KC:k/SRiiX5ahLsrHepNU

Score
10/10

Malware Config

Extracted

Language
ps1
Deobfuscated
URLs
ps1.dropper

https://pt.textbin.net/download/zbbh8tfbo9

Signatures

  • Unsigned PE 1 IoCs

    Checks for missing Authenticode signature.

Files

  • REMCOS-59c861a26a84d17beb487803322d60ec30260556d20d550ac309bc85851eb378.rar
    .rar
  • 59c861a26a84d17beb487803322d60ec30260556d20d550ac309bc85851eb378.js
    .js
  • deobfuscated.js
    .js
  • payload/payload.ps1
    .ps1
  • payload/payload/jsdll.html
  • payload/payload/payload/0.txt
  • payload/payload/payload/payload.exe
    .dll windows:4 windows x86 arch:x86

    dae02f32a21e03ce65412f6e56942daa


    Headers

    Imports

    Sections