Extracted

• • Target
    scan.exe
  • Size 449KB
  • SHA256 1da2a52ea89a09f4950642ee586e398c4cf117a1f0dd50bb1362f635a6720f53
  • MD5 a7e92ba8320c1ca427dc81efd76dc566
  • SHA1 e320bfff52a9b18128624b33021698df51fc8a52
  • SHA512 41c7f88dd2ae80cd21dc2ca35dffa1818c51c1d357262ef99cf6a30e71131da52aa00e804839ea1e22ca60b0a89cf2fa31098c58e0352949df1ad831731d85db
  • SSDEEP 12288:DnVbe7PYad+y0qXl4a/0jpLVGvNQ70JE8vHA:DnVbe7PYajS60jx74HA
  • TLSH
    T177A412A2B274D86BC85256F3C632A8F61BF08E15D82517AB4F007EFE75740520E2B797
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  remotehostcollectiondiscoverydownloaderguloaderremcosinstallerpersistencerat

  • Guloader family

    guloader

  • Guloader,Cloudeye

    A shellcode based downloader first seen in 2020.

    downloaderguloader

  • Remcos

    Remcos is a closed-source remote control and surveillance software.

    ratremcos

  • Remcos family

    remcos

  • Detected Nirsoft tools

    Free utilities often used by attackers which can steal passwords, product keys, etc.

  • NirSoft MailPassView

    Password recovery tool for various email clients

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Accesses Microsoft Outlook accounts

    collection

  • Adds Run key to start application

    persistence

  • Contacts third-party web service commonly abused for C2

    Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.

  • Suspicious use of NtCreateThreadExHideFromDebugger

  • Suspicious use of NtSetInformationThreadHideFromDebugger

  • Suspicious use of SetThreadContext

  behavioral1behavioral2
• • Target
    $PLUGINSDIR/System.dll
  • Size 12KB
  • SHA256 7fb0f8d452fefaac789986b933df050f3d3e4feb8a8d9944ada995f572dcdca1
  • MD5 dd87a973e01c5d9f8e0fcc81a0af7c7a
  • SHA1 c9206ced48d1e5bc648b1d0f54cccc18bf643a14
  • SHA512 4910b39b1a99622ac8b3c42f173bbe7035ac2f8d40c946468e7db7e2868a2da81ea94da453857f06f39957dd690c7f1ba498936a7aaa0039975e472376f92e8f
  • SSDEEP 192:VFiQJ77pJp17C8F1A5xjGNxrgFOgb7lrT/993:97pJp48F2exrg5F/9
  • TLSH
    T1C5425C1583618EF3F5961E3C00667E2F2B79BE3416F100A39FE34481A99A1CF99B5392
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  3^/10

  discovery
  behavioral3behavioral4
• • Target
    Skihop.scr
  • Size 13KB
  • SHA256 d6d85a2c6db3d717997bb14fa1354aab2b89fbc21032c821d823cdfb396a2571
  • MD5 7d5a59237576df796b319511e5ad1c87
  • SHA1 ba170ef37e9993bb51cb97cec45e5fa6efba0d0f
  • SHA512 d5af0150cb47e66ac4fd28a02c7109b235f837f8c562761ef2f9380582261105b7dae0b0b10eb85813543fd9ce0108acf4a342638f6e0de37f332a3c0fd762a0
  • SSDEEP 12:v7DZvDCuqH4EGMJ7DT++5mjA+D1GCdJDnpF6l:jZ+iMR/+s8kgrpFK
  • TLSH
    T1DB5223D4D4CBC13E01C31D040B960095B3117759B1E014F86A0810B249282AC31DC186
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  1^/10
  behavioral5behavioral6