Extracted

• • Target

    NutzenUnterschriftPlanen2024.com.exe

  • Size

    795KB

  • MD5

    50ad24c74502951d0bec1507ca050c46

  • SHA1

    392235b1cf28c1e5e5c4ce98922b472d80fb8d0c

  • SHA256

    e4ed3892cc2c77e7de57a5fc47040118740b1a672747f72193ed065570a55b38

  • SHA512

    e06ac807482380f9b1986f1b064ee215716095aac4350d9427baeeda5a6bfc4a302b048788a3d187e9131620f032e0a6476cbff5f6db9eb2420a56ecbaade5d8

  • SSDEEP

    24576:twh/C6tZbwDaudTLF9AMWR9hoRR7jKzjrh:twE6tZ6dT/A5ORlKzj1

  Score

  10^/10

  guloaderremcosremotehostcollectiondiscoverydownloaderratspywarestealer

  • Guloader,Cloudeye

    A shellcode based downloader first seen in 2020.

    downloaderguloader

  • Remcos

    Remcos is a closed-source remote control and surveillance software.

    ratremcos

  • Detected Nirsoft tools

    Free utilities often used by attackers which can steal passwords, product keys, etc.

  • NirSoft MailPassView

    Password recovery tool for various email clients

  • NirSoft WebBrowserPassView

    Password recovery tool for various web browsers

  • Loads dropped DLL

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Accesses Microsoft Outlook accounts

    collection

  • Suspicious use of NtCreateThreadExHideFromDebugger

  • Suspicious use of NtSetInformationThreadHideFromDebugger

  • Suspicious use of SetThreadContext

  behavioral1behavioral2

• • Target

    $PLUGINSDIR/System.dll

  • Size

    11KB

  • MD5

    9625d5b1754bc4ff29281d415d27a0fd

  • SHA1

    80e85afc5cccd4c0a3775edbb90595a1a59f5ce0

  • SHA256

    c2f405d7402f815d0c3fadd9a50f0bbbb1bab9aa38fe347823478a2587299448

  • SHA512

    dce52b640897c2e8dbfd0a1472d5377fa91fb9cf1aeff62604d014bccbe5b56af1378f173132abeb0edd18c225b9f8f5e3d3e72434aed946661e036c779f165b

  • SSDEEP

    192:eX24sihno00Wfl97nH6BenXwWobpWBTtvShJ5omi7dJWjOlqSlS:D8QIl972eXqlWBFSt273YOlqz

  Score

  3^/10

  discovery
  behavioral3behavioral4