Extracted

• • Target
    Oplysningskontors.exe
  • Size 635KB
  • SHA256 1baa435dd0c1834273117c8fbbf47cbdfba5450ee71c90926affe63f07afbb92
  • MD5 a8eeb48d760948e5e8099bdc13006b70
  • SHA1 70b7a1c068e5b96b303a03f29edb094f6bc5b478
  • SHA512 0737743ae77c8d4077ea726ec57e44786dcfedf20c82dc79f314203f878b42522cee63e1af2ac2832ca1fbd5912a86978f8b3703ab017ed7c7c958ecfa5446d4
  • SSDEEP 12288:gMwzdCO5/bAH4mWDguDwv4uszqaf8BJsaw3bMg6gK0E9:gMwZCOZsYbDguD3qJB0bMgkR9
  • TLSH
    T129D412413ECBEDBAF16158310CE9D95676BABC265EA01A4B73413B3F39316168B0F712
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  remotehostcollectiondiscoveryremcospersistencerat

  • Remcos

    Remcos is a closed-source remote control and surveillance software.

    ratremcos

  • Remcos family

    remcos

  • Detected Nirsoft tools

    Free utilities often used by attackers which can steal passwords, product keys, etc.

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Accesses Microsoft Outlook accounts

    collection

  • Adds Run key to start application

    persistence

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery

  • Contacts third-party web service commonly abused for C2

    Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.

  • Suspicious use of NtCreateThreadExHideFromDebugger

  • Suspicious use of NtSetInformationThreadHideFromDebugger

  • Suspicious use of SetThreadContext

  behavioral1behavioral2
• • Target
    $PLUGINSDIR/System.dll
  • Size 12KB
  • SHA256 acf90ab6f4edc687e94aaf604d05e16e6cfb5e35873783b50c66f307a35c6506
  • MD5 6e55a6e7c3fdbd244042eb15cb1ec739
  • SHA1 070ea80e2192abc42f358d47b276990b5fa285a9
  • SHA512 2d504b74da38edc967e3859733a2a9cacd885db82f0ca69bfb66872e882707314c54238344d45945dc98bae85772aceef71a741787922d640627d3c8ae8f1c35
  • SSDEEP 192:MenY0qWTlt70IAj/lQ0sEWc/wtYbBH2aDybC7y+XBaIwL:M8+Qlt70Fj/lQRY/9VjjgL
  • TLSH
    T1BE428D1193B089F2F590593805A67F2A6FBEAC5C27E44A63CFE345853D702DFA47A243
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  3^/10

  discovery
  behavioral3behavioral4