Extracted

• • Target

    Server_protected.exe

  • Size

    2.8MB

  • MD5

    6c322fce42cecda6465e34424a2071d8

  • SHA1

    b60d414f2a0047fc64066cb321e60149c91abfb3

  • SHA256

    a83b02d1f55f1654d0b38aceb0efe068b62e2d19dcf625af3649bff0fda2b885

  • SHA512

    f1e39bc9253e7ceefb21759e75a0352f65b454b55e5dc6adc098f5ba050fd1da879d8501eb054f920f8a37a0bf5a68c34394089c570af3b3ce12ad14e8bafb71

  • SSDEEP

    49152:ZkpBXL0eovOeG1ahNMWlAUlYoZpwO6v3xOO5UuyYqFSMsyuRjguT3c5gDejqEVLV:ZkpBXLwKwN5pn4xOsNKFNjYxLcmFq0Y

  Score

  10^/10

  hawkeyeremcoshostingevasionkeyloggerpersistenceratspywarestealerthemidatrojan

  • HawkEye

    HawkEye is a malware kit that has seen continuous development since at least 2013.

    keyloggertrojanstealerspywarehawkeye

  • Remcos

    Remcos is a closed-source remote control and surveillance software.

    ratremcos

  • Identifies VirtualBox via ACPI registry values (likely anti-VM)

    evasion

  • Checks BIOS information in registry

    BIOS information is often read in order to detect sandboxing environments.

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Themida packer

    Detects Themida, an advanced Windows software protection system.

    themida

  • Adds Run key to start application

    persistence

  • Checks whether UAC is enabled

    evasiontrojan

  • Drops file in System32 directory

  • Suspicious use of NtSetInformationThreadHideFromDebugger

  • Suspicious use of SetThreadContext

  behavioral1