Extracted

• • Target

    SWIFT.scr

  • Size

    716KB

  • MD5

    c1a83e61f3e5e28fb499b2c204243549

  • SHA1

    08124d6acc7e9f26e99b10f5e909081c788b477a

  • SHA256

    6d4171c68f4f2d1e2f3da572c62247d92cd98684046516cef1bb5a023a538755

  • SHA512

    a0bad0c833d523bc120a7f855f4dbe55226525963ed5d2ef2a811b54738a2accec957e4f2ea8f68bf760ad4b37cc9e741bb735476cbe42ea91df7c930870e034

  • SSDEEP

    12288:LR3BUIpYzX5bjzN1ueIzsbnVzpuRmWczn46l0xFXc3gIwEg:V3GIOjzNnMwVsRmW0nl0Pg73g

  Score

  10^/10

  guloaderremcoshost-2collectioncredential_accessdiscoverydownloaderratspywarestealer

  • Guloader family

    guloader

  • Guloader,Cloudeye

    A shellcode based downloader first seen in 2020.

    downloaderguloader

  • Remcos

    Remcos is a closed-source remote control and surveillance software.

    ratremcos

  • Remcos family

    remcos

  • Detected Nirsoft tools

    Free utilities often used by attackers which can steal passwords, product keys, etc.

  • NirSoft MailPassView

    Password recovery tool for various email clients

  • NirSoft WebBrowserPassView

    Password recovery tool for various web browsers

  • Uses browser remote debugging

    Can be used control the browser and steal sensitive information such as credentials and session cookies.

    credential_accessstealer

  • Loads dropped DLL

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Accesses Microsoft Outlook accounts

    collection

  • Legitimate hosting services abused for malware hosting/C2

  • Suspicious use of NtCreateThreadExHideFromDebugger

  • Suspicious use of NtSetInformationThreadHideFromDebugger

  • Suspicious use of SetThreadContext

  behavioral1behavioral2

• • Target

    $PLUGINSDIR/System.dll

  • Size

    11KB

  • MD5

    a436db0c473a087eb61ff5c53c34ba27

  • SHA1

    65ea67e424e75f5065132b539c8b2eda88aa0506

  • SHA256

    75ed40311875312617d6711baed0be29fcaee71031ca27a8d308a72b15a51e49

  • SHA512

    908f46a855480af6eacb2fb64de0e60b1e04bbb10b23992e2cf38a4cbebdcd7d3928c4c022d7ad9f7479265a8f426b93eef580afec95570e654c360d62f5e08d

  • SSDEEP

    192:aVL7iZJX76BisO7+UZEw+Rl59pV8ghsVJ39dx8T:d7NsOpZsfLMJ39e

  Score

  3^/10

  discovery
  behavioral3behavioral4