General

  • Target

    PO#RMS9877946001 RMSMARINE SERVICE.com.exe

  • Size

    324KB

  • Sample

    240520-gzw9nsff6s

  • MD5

    c1edf662cc928c99865fd2ab6ef1414a

  • SHA1

    091dc4692e01abf4d05798d1669852132bc028c7

  • SHA256

    ffad5809000c0b6127c5b98e03779346bd9ba8edbe44f9cabc3e32af11bf74fb

  • SHA512

    fd508b3b010698e9d101ff4a6896c8a37e2981b8ff4ccf3f0dcd231c011798fbc42b215e27ddda128b2f8618183d10a1a9af77e262475e8fcdc233330573c1f3

  • SSDEEP

    6144:A9X0GAbjQDWUo891UvmRCj02mxD0SUS9ZLrJkje17FlWOae13x:G0t/UoK1UvaCGoHoLmjeVie13x

Malware Config

Targets

    • Target

      PO#RMS9877946001 RMSMARINE SERVICE.com.exe

    • Size

      324KB

    • MD5

      c1edf662cc928c99865fd2ab6ef1414a

    • SHA1

      091dc4692e01abf4d05798d1669852132bc028c7

    • SHA256

      ffad5809000c0b6127c5b98e03779346bd9ba8edbe44f9cabc3e32af11bf74fb

    • SHA512

      fd508b3b010698e9d101ff4a6896c8a37e2981b8ff4ccf3f0dcd231c011798fbc42b215e27ddda128b2f8618183d10a1a9af77e262475e8fcdc233330573c1f3

    • SSDEEP

      6144:A9X0GAbjQDWUo891UvmRCj02mxD0SUS9ZLrJkje17FlWOae13x:G0t/UoK1UvaCGoHoLmjeVie13x

    Score
    10/10
    • Guloader,Cloudeye

      A shellcode based downloader first seen in 2020.

    • NirSoft MailPassView

      Password recovery tool for various email clients

    • NirSoft WebBrowserPassView

      Password recovery tool for various web browsers

    • Nirsoft

    • Loads dropped DLL

    • Target

      $PLUGINSDIR/System.dll

    • Size

      11KB

    • MD5

      4ca4fd3fbefa2f6e87e6e9ee87d1c0b3

    • SHA1

      7cdbeb5ff2b14b86af04e075d0ca651183ea5df4

    • SHA256

      d09a8b3ade4ba4b7292c0b3da1bcb4b6c6e2012e0ccfd5e029a54af73a9e1b57

    • SHA512

      cf0f415a97fdc74568297fed4f1295d0d2aef487a308141144ef8d5f04c669ef4795c273e745b81065429adde113fcdedf4c22717a7aeef60fdcd8d4d46f97f8

    • SSDEEP

      192:EPtkiQJr7V9r3HcU17S8g1w5xzWxy6j2V7i77blbTc4W:j7VpNo8gmOyRsVc4

    Score
    3/10
    • Target

      $PLUGINSDIR/UserInfo.dll

    • Size

      4KB

    • MD5

      035bdb470a6807313bd005bd98341ffc

    • SHA1

      5017d1e5a23f1c64594f737e6fccd519729c3b3e

    • SHA256

      26fa900e3426b4dd272707e1aaf428b5ee06bdc2cc2bbaecdab6b54f11f38f27

    • SHA512

      f888baed5267b05b13722e839634254393aa99b2adf1a2ae6e799d3a901665e7ebda0fa1202db20a6765a8aff58e2ed6f4e822028be426db732eb10ec783aa05

    Score
    3/10
    • Target

      $PLUGINSDIR/nsDialogs.dll

    • Size

      9KB

    • MD5

      eb2c74e05b30b29887b3219f4ea3fdab

    • SHA1

      91173d46b34e7bae57acabdbd239111b5bcc4d9e

    • SHA256

      d253ca5aba34b925796777893f114cc741b015af7868022ab1db2341288c55ed

    • SHA512

      1bb035260223ec585170f891c2624b9ae98671f225e74b913b40bb77b66e3b9c2016037bc8e4b0ae16367d82590a60a0a3bd95d05139ea2454f02020d1b54dae

    • SSDEEP

      96:oVDlD3cd51V1zL7xqEscxM2DjDf3GEst+Nt+jvcx488qndYv0PLE:oVp34z/x3sREskpxjdO0PLE

    Score
    3/10
    • Target

      retouchr.app

    • Size

      4KB

    • MD5

      78c3f9caadc9005059318c41af371f53

    • SHA1

      47427be3d4d5c20b10ebe761d44fc3c6dd82b92f

    • SHA256

      38da1491f6996d1bd6c41949bb0ee04431d1f26991849be89b3a4fae488b76b1

    • SHA512

      250acfc789595818403a27198c930a3dbe006336de9dec2c8c1e097c575d8cd1e2960a5b163975324fdc24b5cc9ce251fa28505cae48a1fe8a9676bc17906120

    • SSDEEP

      96:2JZjKAUt4rE5yHGP/tmB4/cLodXL6FYYVtiCOfKRjY:iZjKAUt4Mh0CkenYQCRjY

    Score
    1/10

MITRE ATT&CK Enterprise v15

Tasks