Extracted

• • Target

    DOCUMENT5885588081366766.pdf.exe

  • Size

    512KB

  • MD5

    053184cbad166da8d6065e1fb934b964

  • SHA1

    54fa68f4233ab168238ea71af23eec2436552a0b

  • SHA256

    c877c021f20392b5c63533b4e59522f17d060d20341a47c76f24b7430c72ad54

  • SHA512

    b6402e9b634cee834db92edfe02f39a77fecfef3ff2836605c2f1276424287e5559a34306a4d376ea999fe0850c27c45d3d16ce00a91d9a65f27ba04c3d6ea69

  • SSDEEP

    12288:1BRxKL/cM4jJL3O80+E3DzGpiOZWWiawo9fv6MIfGYfmBBWMM:JwLkPjJLO6pilWva/fPmo

  Score

  10^/10

  discoveryexecutionremcoswowpersistencerat

  • Remcos

    Remcos is a closed-source remote control and surveillance software.

    ratremcos

  • Remcos family

    remcos

  • Command and Scripting Interpreter: PowerShell

    Run Powershell and hide display window.

    execution

  • Adds Run key to start application

    persistence

  • Blocklisted process makes network request

  • Legitimate hosting services abused for malware hosting/C2

  • Suspicious use of NtCreateThreadExHideFromDebugger

  • Suspicious use of NtSetInformationThreadHideFromDebugger

  behavioral1behavioral2

• • Target

    Tredjelandes.Sel

  • Size

    52KB

  • MD5

    85edb7354ba656bbb556d21c8e68831c

  • SHA1

    e01c029026be5e5d7e17cdd191360d9bbd9d9e27

  • SHA256

    d9b3298dafafc8f85e167c0c739d94cf6671f017e1a0cf7e759ff6158b5921ed

  • SHA512

    b86b8ee9f4f0f0421074de62c439ef5cf63b441f44b95c9a1ca28b357c9fd52c85ba00af70e975f4e5aa4601829026ee2ebec143fb9357815e76635fdf3a28d5

  • SSDEEP

    1536:qOoV6LfQgMGl7Fdwq3BcfTjOYysx3jXpsOWL9z:td5MCFaqxcfTj7vX/kz

  Score

  8^/10

  executionpersistence

  • Boot or Logon Autostart Execution: Active Setup

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

    persistence

  • Enumerates connected drives

    Attempts to read the root path of hard drives other than the default C: drive.

  behavioral3behavioral4