Extracted

• • Target

    c5aceb5a91bf991604daec67bde90bc7.exe

  • Size

    658KB

  • MD5

    c5aceb5a91bf991604daec67bde90bc7

  • SHA1

    66f965774fbee77e43d089281366d1256b312386

  • SHA256

    547ffc87de4f0a1aa0c3031152ba6297e1b0aa81e41fa1d5f97a63318137206d

  • SHA512

    a774095ba9c245ecb217fabbcc3f5a37d9678ef1e304543834a54eb554fb0735b761957cd254c30b5ee0e73638c2992580fffe68b1aadb824e76a8b10c375a6e

  • SSDEEP

    12288:8vPoJfNUnZjJd4Yuz366rLjW4aFdIge89hbL7TWxv69jIQS6lpOYCUjJ+C:8PQfNUnN4dKBdtZN7avBQTlpvCUz

  Score

  10^/10

  guloaderremcosrem_doc2discoverydownloaderexecutionpersistenceratcollectionspywarestealer

  • Guloader,Cloudeye

    A shellcode based downloader first seen in 2020.

    downloaderguloader

  • Remcos

    Remcos is a closed-source remote control and surveillance software.

    ratremcos

  • Detected Nirsoft tools

    Free utilities often used by attackers which can steal passwords, product keys, etc.

  • NirSoft MailPassView

    Password recovery tool for various email clients

  • NirSoft WebBrowserPassView

    Password recovery tool for various web browsers

  • Command and Scripting Interpreter: PowerShell

    Run Powershell and hide display window.

    execution

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Accesses Microsoft Outlook accounts

    collection

  • Adds Run key to start application

    persistence

  • Suspicious use of NtCreateThreadExHideFromDebugger

  • Suspicious use of NtSetInformationThreadHideFromDebugger

  • Suspicious use of SetThreadContext

  behavioral1behavioral2