Extracted

• • Target
    rDEC_SOA.exe
  • Size 393KB
  • SHA256 9fe4d4fa0652fe7d37175a5e866dd0ec2f446c9b1d92ca6eb88dfdaf04984a99
  • MD5 06f5ce2724a8b7857d3b284ac8503438
  • SHA1 3d769e8d3aba579f5a08b6e85685abaae8569113
  • SHA512 c65514adc33dc1c06fbeb90d024d651f2d0601f116752df2be7d1ad0a3dd51ea0c6b45736e39f535fa16cd381ed6e898096ad15fc96d649183f4ea6ac133f0c0
  • SSDEEP 6144:fPX8uRui+eVkVStrMDC72//eJthO8roUpONv2oV7qqM5pu4bwF8UmQK3V8RoLfK:X8AkVQrxzwqJU4olkWF8w20afK
  • MD5 SHA1 SHA512 SSDEEP

  Score

  10^/10

  remotehostcollectiondiscoverydownloaderguloaderremcosinstallerpersistencerat

  • Guloader family

    guloader

  • Guloader,Cloudeye

    A shellcode based downloader first seen in 2020.

    downloaderguloader

  • Remcos

    Remcos is a closed-source remote control and surveillance software.

    ratremcos

  • Remcos family

    remcos

  • Detected Nirsoft tools

    Free utilities often used by attackers which can steal passwords, product keys, etc.

  • NirSoft MailPassView

    Password recovery tool for various email clients

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Accesses Microsoft Outlook accounts

    collection

  • Adds Run key to start application

    persistence

  • Contacts third-party web service commonly abused for C2

    Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.

  • Suspicious use of NtCreateThreadExHideFromDebugger

  • Suspicious use of NtSetInformationThreadHideFromDebugger

  • Suspicious use of SetThreadContext

  behavioral1behavioral2
• • Target
    $PLUGINSDIR/System.dll
  • Size 11KB
  • SHA256 6fcea34c8666b06368379c6c402b5321202c11b00889401c743fb96c516c679e
  • MD5 fccff8cb7a1067e23fd2e2b63971a8e1
  • SHA1 30e2a9e137c1223a78a0f7b0bf96a1c361976d91
  • SHA512 f4335e84e6f8d70e462a22f1c93d2998673a7616c868177cac3e8784a3be1d7d0bb96f2583fa0ed82f4f2b6b8f5d9b33521c279a42e055d80a94b4f3f1791e0c
  • SSDEEP 192:xPtkiQJr7V9r3HcU17S8g1w5xzWxy6j2V7i77blbTc4v:g7VpNo8gmOyRsVc4
  • MD5 SHA1 SHA512 SSDEEP

  Score

  3^/10

  discovery
  behavioral3behavioral4
• • Target
    Preacness/Laminar/glatfret.bat
  • Size 8KB
  • SHA256 beef71952ddbaab878ed1c5db37c380a2bd8c65f48ce161cb7edef635ebd1e9f
  • MD5 4fa2e35e82e0e5c0c27cd80d1801096c
  • SHA1 2d30055a0e6a9e5eabd1b7697bfcd80b6133df5e
  • SHA512 5b37e9f5cd5df3ed9658021fe6bba6fe2daac24fa213e2068ffea6f8cad29d7033d9e76810b91fdba524b60cb173ce9e88c8624c5d52027add41514a9d0e4e47
  • SSDEEP 6:BIiMS24bgv6Wvio8gOuBe4c+DGmdVxpSxsHCsu1SyRHxpae8wCoNmOWKvQTj6uJ:WL4KPibgOuBLcKHVx6E+pahZoNmpD+uJ
  • MD5 SHA1 SHA512 SSDEEP

  Score

  1^/10
  behavioral5behavioral6