Extracted

• • Target

    25FC004658_Femetagershusenes.exe

  • Size

    601KB

  • MD5

    77221f5f2a4984872389759b83446a62

  • SHA1

    07c1d4795c8ec52dff45be198abde62c331ded59

  • SHA256

    d67a5911a1cca695a8e3514e1155c6cc8ace4c1a6b96daf563f6ae3134c6d588

  • SHA512

    bd64bd1be5fc366c600c5c88963e368fa82f31c0e692a27e7a7ce8cad0c5c4ac4d41cbba95e98bb5cfe753c3c157c399a2664b4e490068b18b2c7fe27bf10485

  • SSDEEP

    12288:SDGg/i9HZmS7DpP5AkavuzLiB5Puhrxk/8872b5GmledTRfSCG+sQCVv:jD5PUkwuKB8rxk0omle3VG+shVv

  Score

  10^/10

  guloaderremcosparosh newdiscoverydownloaderpersistencerat

  • Guloader family

    guloader

  • Guloader,Cloudeye

    A shellcode based downloader first seen in 2020.

    downloaderguloader

  • Remcos

    Remcos is a closed-source remote control and surveillance software.

    ratremcos

  • Remcos family

    remcos

  • Boot or Logon Autostart Execution: Active Setup

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

    persistence

  • Executes dropped EXE

  • Loads dropped DLL

  • Adds Run key to start application

    persistence

  • Suspicious use of NtCreateThreadExHideFromDebugger

  • Suspicious use of NtSetInformationThreadHideFromDebugger

  behavioral1behavioral2

• • Target

    $PLUGINSDIR/System.dll

  • Size

    11KB

  • MD5

    ee260c45e97b62a5e42f17460d406068

  • SHA1

    df35f6300a03c4d3d3bd69752574426296b78695

  • SHA256

    e94a1f7bcd7e0d532b660d0af468eb3321536c3efdca265e61f9ec174b1aef27

  • SHA512

    a98f350d17c9057f33e5847462a87d59cbf2aaeda7f6299b0d49bb455e484ce4660c12d2eb8c4a0d21df523e729222bbd6c820bf25b081bc7478152515b414b3

  • SSDEEP

    192:eF24sihno00Wfl97nH6T2enXwWobpWBTU4VtHT7dmN35Ol9Sl:h8QIl975eXqlWBrz7YLOl9

  Score

  3^/10

  discovery
  behavioral3behavioral4