Extracted

• • Target

    0daec5d74297591bda4fb4aedd1c91643b7cd4312d65e5eb664d2328f0cd5c52.exe

  • Size

    623KB

  • MD5

    a1cc10092e7a19859fb5bcc32101578b

  • SHA1

    ddd0c1097cb8b4a24699c88adf23ac020121fc16

  • SHA256

    0daec5d74297591bda4fb4aedd1c91643b7cd4312d65e5eb664d2328f0cd5c52

  • SHA512

    f1572a9847203fe81736d7e8cf639d04d461646cab798f5699a6e5b94d97797114e273fddfe1fb8776297ee7f1dbe980e30da8921234cf0cc14db22c388743ed

  • SSDEEP

    12288:7R2/D6NgsWNlQp1TFqblyEocs8vMylZrwnwXifiKPt4r:Y/mWNlQp1cpyEocZMyDzXiaKl4r

  Score

  10^/10

  guloaderremcosremotehostcollectiondownloaderrat

  • Guloader,Cloudeye

    A shellcode based downloader first seen in 2020.

    downloaderguloader

  • Remcos

    Remcos is a closed-source remote control and surveillance software.

    ratremcos

  • Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003)

  • Detects executables built or packed with MPress PE compressor

  • Detects executables referencing many confidential data stores found in browsers, mail clients, cryptocurreny wallets, etc. Observed in information stealers

  • Detects executables referencing many email and collaboration clients. Observed in information stealers

  • NirSoft MailPassView

    Password recovery tool for various email clients

  • NirSoft WebBrowserPassView

    Password recovery tool for various web browsers

  • Nirsoft

  • Loads dropped DLL

  • Accesses Microsoft Outlook accounts

    collection

  • Suspicious use of NtCreateThreadExHideFromDebugger

  • Suspicious use of NtSetInformationThreadHideFromDebugger

  • Suspicious use of SetThreadContext

  behavioral1behavioral2

• • Target

    $PLUGINSDIR/nsExec.dll

  • Size

    6KB

  • MD5

    fa299e199922b3ba833be655a8d71b75

  • SHA1

    4d74c53bb6927a2831df93af26f3e4e4fb007797

  • SHA256

    49a6a1c1f19574b2a247ce6c5adc0751e046d27c30912816ba415f871b74ae5d

  • SHA512

    7ceb64d3d826762994c48ffad3ad2234410cbcdbedfce9a2dc03d18915ce22d687173f90e954d7bdb0eae76954c360059ad761aedc48cd7fa4ec29d6094f6a65

  • SSDEEP

    96:v7fhZwXd8KgEbAa9PweF1WxD8ZLMJGgmkNO38:4N8KgWAuLWxD8ZAGgmkN

  Score

  3^/10
  behavioral3behavioral4

• • Target

    Mellemregningen14.Dum

  • Size

    50KB

  • MD5

    c1a99f6520552a8cd0186b390887b21c

  • SHA1

    1982354532b61d5a6f34758473ba8fa0d526aac9

  • SHA256

    e6df54df126140a5a615ad2ef44fc375a6276080fd1c39ad6bd16dbb5e3c2204

  • SHA512

    fe5f00348ca1e8a618dee573d45aeed609d91d24119a9b1609aa77c9cbb9ee901892c137020fb13bd037e316620c91a299cead1ff7f48a28713d450ba326a1be

  • SSDEEP

    1536:Ph2HGRZuseVJyL798Baok5Ezn+Yx1dU7gLBwgR:KGruBJs7Ork5Y7s7MBwgR

  Score

  8^/10

  persistence

  • Modifies Installed Components in the registry

    persistence

  • Enumerates connected drives

    Attempts to read the root path of hard drives other than the default C: drive.

  behavioral5behavioral6