Extracted

• • Target

    2181299d4ea8b342a975ace1aed20c49c9ec86d46af6575f31ac1cfcbc240d68.exe

  • Size

    519KB

  • MD5

    cfd30b0bf833178f0d730ae3703b4c56

  • SHA1

    de278f275878b570ce2a5efb69456555e888eaae

  • SHA256

    2181299d4ea8b342a975ace1aed20c49c9ec86d46af6575f31ac1cfcbc240d68

  • SHA512

    109deb972cf14b889687ffd58587a603fd9bd4b2a744bc4fb033552e8148a7232e8021db973432335a9ea1dcc2518effee11eb57ad85c3b34d2239fcc50461b9

  • SSDEEP

    6144:sp8oOpVQtWBonIuwtkzixAn9EF99+wykDaxfnasuDjvdjplyTztn1xT4p+/l/JbX:po+VIWBonIuwQn9EF99+SDRfnqBr+KsW

  Score

  10^/10

  guloaderremcosremotehostcollectioncredential_accessdiscoverydownloaderratspywarestealer

  • Guloader,Cloudeye

    A shellcode based downloader first seen in 2020.

    downloaderguloader

  • Remcos

    Remcos is a closed-source remote control and surveillance software.

    ratremcos

  • Credentials from Password Stores: Credentials from Web Browsers

    Malicious Access or copy of Web Browser Credential store.

    credential_accessstealer

  • Detected Nirsoft tools

    Free utilities often used by attackers which can steal passwords, product keys, etc.

  • NirSoft MailPassView

    Password recovery tool for various email clients

  • NirSoft WebBrowserPassView

    Password recovery tool for various web browsers

  • Loads dropped DLL

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Accesses Microsoft Outlook accounts

    collection

  • Suspicious use of NtCreateThreadExHideFromDebugger

  • Suspicious use of NtSetInformationThreadHideFromDebugger

  • Suspicious use of SetThreadContext

  behavioral1behavioral2

• • Target

    $PLUGINSDIR/System.dll

  • Size

    11KB

  • MD5

    3f176d1ee13b0d7d6bd92e1c7a0b9bae

  • SHA1

    fe582246792774c2c9dd15639ffa0aca90d6fd0b

  • SHA256

    fa4ab1d6f79fd677433a31ada7806373a789d34328da46ccb0449bbf347bd73e

  • SHA512

    0a69124819b7568d0dea4e9e85ce8fe61c7ba697c934e3a95e2dcfb9f252b1d9da7faf8774b6e8efd614885507acc94987733eba09a2f5e7098b774dfc8524b6

  • SSDEEP

    192:OPtkumJX7zB22kGwfy0mtVgkCPOsX1un:/702k5qpdsXQn

  Score

  3^/10

  discovery
  behavioral3behavioral4