Extracted

• • Target
    SHIPMENT-CMA000322-00093930-PDF.exe
  • Size 842KB
  • SHA256 6cc7bffeea67e08d4e10ec4d62e5d9cfeca4a3fe72beebfa9d17f2db8d033ebc
  • MD5 ed1c9009eb571f93c4d681e0d2e990af
  • SHA1 59f38766a4dbfd9f80880e86a005dc022c6dc76c
  • SHA512 87ef602ff80697a457a6f537d320ba1a72017a5cabadcb25f3cce3c3b872ef5813a43c19f7b18bd69f171eba91a5f963d3176aa094b23bf6b72a274bb514a8b1
  • SSDEEP 24576:BMwWY2BGE86jGAFPnAvc7qWe3ESBobebbr+gL:BMwf2BjFjnFPnMc7q70zbMbr9
  • MD5 SHA1 SHA512 SSDEEP

  Score

  10^/10

  remotehostcollectiondiscoveryexecutionremcosrat

  • Remcos

    Remcos is a closed-source remote control and surveillance software.

    ratremcos

  • Remcos family

    remcos

  • Detected Nirsoft tools

    Free utilities often used by attackers which can steal passwords, product keys, etc.

  • NirSoft MailPassView

    Password recovery tool for various email clients

  • NirSoft WebBrowserPassView

    Password recovery tool for various web browsers

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Accesses Microsoft Outlook accounts

    collection

  • Badlisted process makes network request

    Network request originating from process or tool commonly abused by malware.

  • Legitimate hosting services abused for malware hosting/C2

  • Suspicious use of NtCreateThreadExHideFromDebugger

  • Suspicious use of NtSetInformationThreadHideFromDebugger

  • Suspicious use of SetThreadContext

  behavioral1behavioral2
• • Target
    Forsviredes51.yer
  • Size 51KB
  • SHA256 4bb8319ba63f70866bdcb92af472c346b3c023bbf1142ec3adb36f5a431a0c7c
  • MD5 d5d48a79535f63f50b9d0b21e588552a
  • SHA1 78b2578b3c158c6b8ccf8b58edacc31d0d6b20ae
  • SHA512 1a09e9f2b5e9e30aa36cc7d3c6d55cfda47a07d144c4899eedaa947bc5f1cc3d619c5c60581af4e32550db232c6f8a57dc672529eb8dfcfba097778f522f74f4
  • SSDEEP 1536:SZ2dW/vfNbupXE3sfzb0WmZDShutNhBzh5qdbEkVn9Qw1c0:SZWWXfgpU8fz4WmZeONhBd5abEU9Qa
  • MD5 SHA1 SHA512 SSDEEP

  Score

  8^/10

  adwareexecutionpersistencespywareransomware

  • Boot or Logon Autostart Execution: Active Setup

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

    persistence

  • Enumerates connected drives

    Attempts to read the root path of hard drives other than the default C: drive.

  behavioral3behavioral4