Extracted

• • Target

    Employee Performance Report_pdf.exe

  • Size

    905KB

  • MD5

    4d936712b148d8e083aa300c2cb722da

  • SHA1

    4b6f6d71140b8df5cdb952ef24ca8caac8b58b9b

  • SHA256

    9afdb7400c9c3d7dfe2fa696ac8d95e2049f1a3367cc3345848ce91f40928bb1

  • SHA512

    17cf1f6d30b7d86e3dda497d9f75a954b63d369a2bd6fdbd7d5efe2a94b43184186e312fc96e748f96ea50caab65efe5765f9e16b4de57942f4af82adab2a6e2

  • SSDEEP

    24576:xYi54ltxFsaopF0YL1uPkQWNRIyE2mPcd:OJDFsaopFt1OkTD

  Score

  10^/10

  guloaderremcosremotehostdiscoverydownloaderpersistencerat

  • Guloader family

    guloader

  • Guloader,Cloudeye

    A shellcode based downloader first seen in 2020.

    downloaderguloader

  • Remcos

    Remcos is a closed-source remote control and surveillance software.

    ratremcos

  • Remcos family

    remcos

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Adds Run key to start application

    persistence

  • Legitimate hosting services abused for malware hosting/C2

  • Suspicious use of NtCreateThreadExHideFromDebugger

  • Suspicious use of NtSetInformationThreadHideFromDebugger

  behavioral1

• • Target

    $PLUGINSDIR/System.dll

  • Size

    12KB

  • MD5

    cff85c549d536f651d4fb8387f1976f2

  • SHA1

    d41ce3a5ff609df9cf5c7e207d3b59bf8a48530e

  • SHA256

    8dc562cda7217a3a52db898243de3e2ed68b80e62ddcb8619545ed0b4e7f65a8

  • SHA512

    531d6328daf3b86d85556016d299798fa06fefc81604185108a342d000e203094c8c12226a12bd6e1f89b0db501fb66f827b610d460b933bd4ab936ac2fd8a88

  • SSDEEP

    192:Zjvco0qWTlt70m5Aj/lQ0sEWD/wtYbBHFNaDybC7y+XBz0QPi:FHQlt70mij/lQRv/9VMjzr

  Score

  3^/10

  discovery
  behavioral2