Extracted

• • Target
    Trigae.exe
  • Size 424KB
  • SHA256 32839e5fa6a7e0f95d88153b87b2234f07df06228b9f62517a1b47a737e5d1ed
  • MD5 1d8341fb71f4f2301f6577aa5fa3c678
  • SHA1 b45b312ffc799c40bfa278c71a46550ffae0048e
  • SHA512 0744da5da13d951507971fa4b0fb18221b1cd986a8b347afa91d971cbae3df7bdc375cf7200d604f3ed00aa8cf418bc885f67528a06f2c0c3a4e7e3b8a8c6cd3
  • SSDEEP 6144:x5lz/1R2mcE9J4XhEn/lb3809+aFKkVsIHDMq6gNDtj8Dx6gk:rfr9J4XI9b379+ol2Opz4Zk
  • TLSH
    T1FF94F1037780CBA7C46487314AAF8715B736FD165BC2270B3398B7592DB3362291A79E
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  remotehostcollectiondiscoveryremcospersistencerat

  • Remcos

    Remcos is a closed-source remote control and surveillance software.

    ratremcos

  • Remcos family

    remcos

  • Detected Nirsoft tools

    Free utilities often used by attackers which can steal passwords, product keys, etc.

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Accesses Microsoft Outlook accounts

    collection

  • Adds Run key to start application

    persistence

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery

  • Contacts third-party web service commonly abused for C2

    Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.

  • Suspicious use of NtCreateThreadExHideFromDebugger

  • Suspicious use of NtSetInformationThreadHideFromDebugger

  • Suspicious use of SetThreadContext

  behavioral1behavioral2
• • Target
    $PLUGINSDIR/System.dll
  • Size 12KB
  • SHA256 3eb38ae99653a7dbc724132ee240f6e5c4af4bfe7c01d31d23faf373f9f2eaca
  • MD5 0d7ad4f45dc6f5aa87f606d0331c6901
  • SHA1 48df0911f0484cbe2a8cdd5362140b63c41ee457
  • SHA512 c07de7308cb54205e8bd703001a7fe4fd7796c9ac1b4bb330c77c872bf712b093645f40b80ce7127531fe6746a5b66e18ea073ab6a644934abed9bb64126fea9
  • SSDEEP 192:1enY0LWelt70elWjvfstJcVtwtYbjnIOg5AaDnbC7ypXhtIj:18PJlt70esj0Mt9vn6ay6
  • TLSH
    T1BA428E12977049F2F1A0183C10A67F265FBEAE5C1BE445A39FE380867D652DF9436343
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  3^/10

  discovery
  behavioral3behavioral4