Extracted

Extracted

Extracted

• • Target
    Nº 2502268142.pdf .exe
  • Size 503KB
  • SHA256 cdefe4487062cf4feeee912c4842224c9f9ee066574205d31efa87aee71f2073
  • MD5 fc2ae0b717c99fc84195eb2ad2bd24e2
  • SHA1 4788ac87473bd247b4cabe68d67d2e5ba32b6936
  • SHA512 06445962cbe741b4c56f3ba93f6feff970f4801044af7ab53e87e7023a83ec53df7e95e8c79bb8cb656e7c3f78c5609db0bd8d6b168447a8a4a259853baf0925
  • SSDEEP 6144:4gYV1lh5pIiZuorxte5gLJl512oJsDg5kGAM1c6E+1hKYTq8uqbmWAV6naLnyhfM:SV1l3zZjrx550omh69b2W8jytCU+L
  • MD5 SHA1 SHA512 SSDEEP

  Score

  10^/10

  discoveryexecspain2collectiondefense_evasionexecutionquasarremcosxwormpersistenceratspywarestealertrojan

  • Detect Xworm Payload

  • Quasar RAT

    Quasar is an open source Remote Access Tool.

    trojanspywarequasar

  • Quasar family

    quasar

  • Quasar payload

  • Remcos

    Remcos is a closed-source remote control and surveillance software.

    ratremcos

  • Remcos family

    remcos

  • Xworm

    Xworm is a remote access trojan written in C#.

    trojanratxworm

  • Xworm family

    xworm

  • Badlisted process makes network request

    Network request originating from process or tool commonly abused by malware.

  • Downloads MZ/PE file

  • .NET Reactor proctector

    Detects an executable protected by an unregistered version of Eziriz's .NET Reactor.

  • Drops startup file

  • Executes dropped EXE

  • Loads dropped DLL

  • Reads WinSCP keys stored on the system

    Tries to access WinSCP stored sessions.

    spywarestealer

  • Reads user/profile data of local email clients

    Email clients store some user data on disk where infostealers will often target it.

    spywarestealer

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Accesses Microsoft Outlook profiles

    collection

  • Adds Run key to start application

    persistence

  • Obfuscated Files or Information: Command Obfuscation

    Adversaries may obfuscate content during command execution to impede detection.

    defense_evasion

  • Suspicious use of SetThreadContext

  behavioral1behavioral2