Extracted

• • Target

    SalaryIncrement_pdf.exe

  • Size

    873KB

  • MD5

    82661a36b40f6141d10a5561fe037475

  • SHA1

    8e87b0db80746d9accd610448df36211c0623ff4

  • SHA256

    7d467f539d901aff827ae34f26fcadb232318cde5a1e76fb2283664e968fbb18

  • SHA512

    90a173f4749ac4a00d49641629801830d5e60d33aff5404315407885777c703e2b690a0b83f776e9e546ed447b7829ed27e3c3e79dd9ca43e70b79af3b0ffb2c

  • SSDEEP

    24576:9NJ+8FbCssFhmUUo551pLVlu3nbKYWJfScJ81uO:7pZCPFco551pLy3b0J81p

  Score

  10^/10

  guloaderremcosremotehostdiscoverydownloaderpersistencerat

  • Guloader family

    guloader

  • Guloader,Cloudeye

    A shellcode based downloader first seen in 2020.

    downloaderguloader

  • Remcos

    Remcos is a closed-source remote control and surveillance software.

    ratremcos

  • Remcos family

    remcos

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Adds Run key to start application

    persistence

  • Legitimate hosting services abused for malware hosting/C2

  • Drops file in System32 directory

  • Suspicious use of NtCreateThreadExHideFromDebugger

  • Suspicious use of NtSetInformationThreadHideFromDebugger

  behavioral1

• • Target

    $PLUGINSDIR/System.dll

  • Size

    12KB

  • MD5

    cff85c549d536f651d4fb8387f1976f2

  • SHA1

    d41ce3a5ff609df9cf5c7e207d3b59bf8a48530e

  • SHA256

    8dc562cda7217a3a52db898243de3e2ed68b80e62ddcb8619545ed0b4e7f65a8

  • SHA512

    531d6328daf3b86d85556016d299798fa06fefc81604185108a342d000e203094c8c12226a12bd6e1f89b0db501fb66f827b610d460b933bd4ab936ac2fd8a88

  • SSDEEP

    192:Zjvco0qWTlt70m5Aj/lQ0sEWD/wtYbBHFNaDybC7y+XBz0QPi:FHQlt70mij/lQRv/9VMjzr

  Score

  3^/10

  discovery
  behavioral2