Extracted

• • Target

    Employee Survey Report.exe

  • Size

    579KB

  • MD5

    d09ac658ad967dd3e077796add0fc14b

  • SHA1

    33da36025ee22d79061b821e61f3c0c72ff64eb7

  • SHA256

    0f7cc1fc0f0c0a46c171edb05dd03c02799e482ba6086102112231b49c5b79fd

  • SHA512

    61d1d1cb454a56c356457e24021f33d567b575d92ccb4fd9f1aea3f73c94ae9945ea7ddd6e29ded039427b69cc4db1cf41b3922e0df27e37bafa801aebe15d56

  • SSDEEP

    12288:ctoOorqN1s8mmkPy10BbbwguEZlPBrUlqbihJZQHrmYrDZ9:NOocCmkPy2BbUguEVEbWHrmYn/

  Score

  10^/10

  guloaderremcosremotehostdiscoverydownloaderpersistencerat

  • Guloader family

    guloader

  • Guloader,Cloudeye

    A shellcode based downloader first seen in 2020.

    downloaderguloader

  • Remcos

    Remcos is a closed-source remote control and surveillance software.

    ratremcos

  • Remcos family

    remcos

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Adds Run key to start application

    persistence

  • Legitimate hosting services abused for malware hosting/C2

  • Drops file in System32 directory

  • Suspicious use of NtCreateThreadExHideFromDebugger

  • Suspicious use of NtSetInformationThreadHideFromDebugger

  behavioral1

• • Target

    $PLUGINSDIR/System.dll

  • Size

    11KB

  • MD5

    ca332bb753b0775d5e806e236ddcec55

  • SHA1

    f35ef76592f20850baef2ebbd3c9a2cfb5ad8d8f

  • SHA256

    df5ae79fa558dc7af244ec6e53939563b966e7dbd8867e114e928678dbd56e5d

  • SHA512

    2de0956a1ad58ad7086e427e89b819089f2a7f1e4133ed2a0a736adc0614e8588ebe2d97f1b59ab8886d662aeb40e0b4838c6a65fbfc652253e3a45664a03a00

  • SSDEEP

    192:eo24sihno00Wfl97nH6T2enXwWobpWBTU4VtHT7dmN35Ol6Sl:k8QIl975eXqlWBrz7YLOl6

  Score

  3^/10

  discovery
  behavioral2