Extracted

• • Target
    scan.exe
  • Size 432KB
  • SHA256 62ea4446b44f3afbe6cc5dcf473d25527e03f7e31a14dc4078f0224fecabf0f5
  • MD5 c1e9592d23d5ff17a26ef804fa8fa7bd
  • SHA1 2940b55a0a5dd544a16f9749952114dcdc0a4c3c
  • SHA512 a7d0411dafc46bb8918303b1f9d20215924c36c10e9c5f633a442a718ef10b45ac240f6f74b9ceea4818a6e0f6297e8c14fcfbda46a3bfa3c5e8d4e36dc35a2c
  • SSDEEP 12288:5Rfu8gWXmW+qhk7KOOSW8T2T6hOC2FUrsIM253:rfu3Wfhk7KVStz33
  • MD5 SHA1 SHA512 SSDEEP

  Score

  10^/10

  remotehostcollectiondiscoveryremcospersistencerat

  • Remcos

    Remcos is a closed-source remote control and surveillance software.

    ratremcos

  • Remcos family

    remcos

  • Detected Nirsoft tools

    Free utilities often used by attackers which can steal passwords, product keys, etc.

  • NirSoft MailPassView

    Password recovery tool for various email clients

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Accesses Microsoft Outlook accounts

    collection

  • Adds Run key to start application

    persistence

  • Legitimate hosting services abused for malware hosting/C2

  • Suspicious use of NtCreateThreadExHideFromDebugger

  • Suspicious use of NtSetInformationThreadHideFromDebugger

  • Suspicious use of SetThreadContext

  behavioral1behavioral2
• • Target
    $PLUGINSDIR/System.dll
  • Size 12KB
  • SHA256 f917aef484d1fbb4d723b2e2d3045cb6f5f664e61fbb3d5c577bd1c215de55d9
  • MD5 d6f54d2cefdf58836805796f55bfc846
  • SHA1 b980addc1a755b968dd5799179d3b4f1c2de9d2d
  • SHA512 ce67da936a93d46ef7e81abc8276787c82fd844c03630ba18afc3528c7e420c3228bfe82aeda083bb719f2d1314afae913362abd1e220cb364606519690d45db
  • SSDEEP 192:acA1YOTDExj7EFrYCT4E8y3hoSdtTgwF43E7QbGPXI9uIc6w79Mw:RR7SrtTv53tdtTgwF4SQbGPX36wJMw
  • MD5 SHA1 SHA512 SSDEEP

  Score

  3^/10

  discovery
  behavioral3behavioral4