Extracted

• • Target
    Staffreport.exe
  • Size 678KB
  • SHA256 caf44a2d4d469a2ec1b8acf1df9e5dabb3561bc7d580ea0e83a3523bde454bf8
  • MD5 47e5526a49468b5f09a308bdbcc14429
  • SHA1 1178819f033897aa05661ceadf24149e0f56ec19
  • SHA512 611a9a0533404bf26da8e0f317648002dd8403da4aec23c64a46d41add89522cb4b38fef618a2bc2a595824e373dc93fbff7650ebd97349b3759b95d823a5449
  • SSDEEP 12288:nNbPw+zB8c70DtiqjkyZMGFPxiBrzz64dCA1EVB22e/LVo:nN8+zB8c4D0OMmcBHu4YA1EVBC/5o
  • MD5 SHA1 SHA512 SSDEEP

  Score

  10^/10

  remcoscollectiondiscoverypersistencerat

  • Remcos

    Remcos is a closed-source remote control and surveillance software.

    ratremcos

  • Remcos family

    remcos

  • Detected Nirsoft tools

    Free utilities often used by attackers which can steal passwords, product keys, etc.

  • NirSoft MailPassView

    Password recovery tool for various email clients

  • NirSoft WebBrowserPassView

    Password recovery tool for various web browsers

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Accesses Microsoft Outlook accounts

    collection

  • Adds Run key to start application

    persistence

  • Legitimate hosting services abused for malware hosting/C2

  • Suspicious use of NtCreateThreadExHideFromDebugger

  • Suspicious use of NtSetInformationThreadHideFromDebugger

  • Suspicious use of SetThreadContext

  behavioral1behavioral2
• • Target
    $PLUGINSDIR/System.dll
  • Size 12KB
  • SHA256 8dc562cda7217a3a52db898243de3e2ed68b80e62ddcb8619545ed0b4e7f65a8
  • MD5 cff85c549d536f651d4fb8387f1976f2
  • SHA1 d41ce3a5ff609df9cf5c7e207d3b59bf8a48530e
  • SHA512 531d6328daf3b86d85556016d299798fa06fefc81604185108a342d000e203094c8c12226a12bd6e1f89b0db501fb66f827b610d460b933bd4ab936ac2fd8a88
  • SSDEEP 192:Zjvco0qWTlt70m5Aj/lQ0sEWD/wtYbBHFNaDybC7y+XBz0QPi:FHQlt70mij/lQRv/9VMjzr
  • MD5 SHA1 SHA512 SSDEEP

  Score

  3^/10

  discovery
  behavioral3behavioral4