Extracted

• • Target
    Appointment Confirmation Letter-1853013-1-PDF.exe
  • Size 803KB
  • SHA256 fd01d87191d287eef1b56ad193c9be2ab4abe4db90fa948b96ae5e69feb7792d
  • MD5 201c51b293f4cfca1b3d24ce1839b6b2
  • SHA1 a8c58d6f33568587a93002be32dfb2d365f2ee6a
  • SHA512 b40732483f7fb6f78c94764975152705da3635f00ac003d587d243449224c88b30fd82d7724f298e2c72eb6e62fadd4c654175c81694294712dce2512a34fb48
  • SSDEEP 24576:AbsJmfnxJPgeKNA5RigtiABYj4Mp7qQ1YtyergWQ:KsJmZKeKNO9t3BY807P1YserO
  • MD5 SHA1 SHA512 SSDEEP

  Score

  10^/10

  discoveryexecutionremcospersistencerat

  • Remcos

    Remcos is a closed-source remote control and surveillance software.

    ratremcos

  • Remcos family

    remcos

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Adds Run key to start application

    persistence

  • Badlisted process makes network request

    Network request originating from process or tool commonly abused by malware.

  • Legitimate hosting services abused for malware hosting/C2

  • Suspicious use of NtCreateThreadExHideFromDebugger

  • Suspicious use of NtSetInformationThreadHideFromDebugger

  behavioral1behavioral2
• • Target
    Drtrinnets/Saldoliste.Kra
  • Size 54KB
  • SHA256 276ccd12a2e1f58d711f8b24675dc736e22102f83ee58f5a5b48d798e70672bd
  • MD5 65ed8fb88f319b4d3ad292666d242ef8
  • SHA1 043e6eef64abe15f2e207235d350b6f53bebf2ac
  • SHA512 a62f9b0c0bd68463666abca6f8915aafdf344ba9cdc18191cc4acec4a2a658a8ea35c07fa6b8e55404c0e28f50d9e871aa37280b76852393a21998f95a8ac943
  • SSDEEP 768:Vhu1qICeBSe9JzeysooebW6DcfxIK66mRjd138OXY2ijm6g:61qIbhnAfQRjdB4Bg
  • MD5 SHA1 SHA512 SSDEEP

  Score

  8^/10

  adwareexecutionpersistencespywareransomware

  • Boot or Logon Autostart Execution: Active Setup

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

    persistence

  • Enumerates connected drives

    Attempts to read the root path of hard drives other than the default C: drive.

  behavioral3behavioral4