Extracted

• • Target
    img20260107_10522882_PDF.exe
  • Size 712KB
  • SHA256 fa191e9b3dacae45a036c5e3891cef5bea41bafbc3edf621747bc52a5cee8f63
  • MD5 bfce28f25954ddd39a295e3fd3c3f235
  • SHA1 7f46e8032233f62db6305fdcca724d822148c4e7
  • SHA512 60a2916c797b8992c7e1a726767761c5420dcbbc77f54b00a54d6b2436f5d0c49d9977f7e1ada488562c982fb72449a83196d022dcdbb8d443f1d645519069e4
  • SSDEEP 12288:jFcyz8jtPgbkLX2pEcBFIikrgXGKXMZcJ1US2GDCO3xJVQYEzHi8LjlHuP:jF4ZPg4X2qcdpGK8ZcXGOhJV2zHzL90
  • MD5 SHA1 SHA512 SSDEEP

  Score

  10^/10

  remotehostdiscoverydownloaderguloaderremcosinstallerpersistencerat

  • Guloader family

    guloader

  • Guloader,Cloudeye

    A shellcode based downloader first seen in 2020.

    downloaderguloader

  • Remcos

    Remcos is a closed-source remote control and surveillance software.

    ratremcos

  • Remcos family

    remcos

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Adds Run key to start application

    persistence

  • Contacts third-party web service commonly abused for C2

    Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.

  • Suspicious use of NtCreateThreadExHideFromDebugger

  • Suspicious use of NtSetInformationThreadHideFromDebugger

  behavioral1behavioral2
• • Target
    $PLUGINSDIR/System.dll
  • Size 11KB
  • SHA256 fa4ab1d6f79fd677433a31ada7806373a789d34328da46ccb0449bbf347bd73e
  • MD5 3f176d1ee13b0d7d6bd92e1c7a0b9bae
  • SHA1 fe582246792774c2c9dd15639ffa0aca90d6fd0b
  • SHA512 0a69124819b7568d0dea4e9e85ce8fe61c7ba697c934e3a95e2dcfb9f252b1d9da7faf8774b6e8efd614885507acc94987733eba09a2f5e7098b774dfc8524b6
  • SSDEEP 192:OPtkumJX7zB22kGwfy0mtVgkCPOsX1un:/702k5qpdsXQn
  • MD5 SHA1 SHA512 SSDEEP

  Score

  3^/10

  discovery
  behavioral3behavioral4