Extracted

• • Target
    08-009-TA-9036&37AWAJI.pdf
  • Size 534KB
  • SHA256 6a8dd48130e893ca6f9de2b880ed9d889fe4b261ebc8bb9fcbfd22026c7722d9
  • MD5 c96b4638ca5823e3eb3fab56a7f8d0c5
  • SHA1 c8b65544d8bb6bdf70a37ee7211abaec9042df38
  • SHA512 170fd9089773725f16025ddd3510f065be8956d80116967e2c62fbfc922a25f836e1a5f63d7c07d269f8a46a9d38cd644e4b99395f3b28caf6fcfe68011e941b
  • SSDEEP 12288:pxxfYiMaDQLhhNHe0sC6O/TwIu244PoDw12+UhOLaFKNB:NYiMvLhhNHTn6O/TbuTDw4gugNB
  • MD5 SHA1 SHA512 SSDEEP

  Score

  3^/10

  adwarediscoveryspyware
  behavioral1behavioral2
• • Target
    SEPTMER ORDER HGH-PO25012 - PTWH SMS EL49.scr
  • Size 1.1MB
  • SHA256 242418928ee50cd9d4c70bddf5b9434ee65244aa46376f123f1c59359c281eaa
  • MD5 0755252c826a1427e4599d22c5fee3f8
  • SHA1 bc9295b5c7575678508822e38dbae2306775d2ae
  • SHA512 013cc54559a7c172519a28916bc7dc828dd4de84f50f605daf7665164fb9a0f771b9a6fd44a6c1235e0cff100534534453d631855a4692532edf95d7f6f59203
  • SSDEEP 24576:N+tTZr1FlRx+DOq+2Bq4LhiLIKhpfRgaUaawteiEOhwWZ:Ed1FlRIDOqPJFKzR7ZbteEh
  • MD5 SHA1 SHA512 SSDEEP

  Score

  10^/10

  collectioncredential_accessdiscoveryexecutionremcospersistenceratstealer

  • Remcos

    Remcos is a closed-source remote control and surveillance software.

    ratremcos

  • Remcos family

    remcos

  • Detected Nirsoft tools

    Free utilities often used by attackers which can steal passwords, product keys, etc.

  • NirSoft MailPassView

    Password recovery tool for various email clients

  • NirSoft WebBrowserPassView

    Password recovery tool for various web browsers

  • Command and Scripting Interpreter: PowerShell

    Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

    execution

  • Uses browser remote debugging

    Can be used control the browser and steal sensitive information such as credentials and session cookies.

    credential_accessstealer

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Accesses Microsoft Outlook accounts

    collection

  • Adds Run key to start application

    persistence

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Suspicious use of SetThreadContext

  behavioral3behavioral4