Extracted

Extracted

Extracted

• • Target
    RC7.exe
  • Size 161KB
  • SHA256 e0be0a8c8c741e821bea2b66c2aea511e33da9aaf9199a30f6df4dd1ba36f980
  • MD5 e2ad1bddc8d34238225a5cfbb456bef8
  • SHA1 a1087b7f46cc33dcf794bb53bb180f7e4796fd3a
  • SHA512 af9c32fade5e06b4443d86917b1f85d59fab7df003970c5c3491463092d0f6067d474bb9f7fae6f1beec4f21a3776f94b8b5fbc3bcb15423304c76781342619c
  • SSDEEP 3072:y9aH7fFuyMf1pX9VHQy3+T9V6ys2IEEUAzMlzriX5ZUblMq9Cb:y9aHjFF0zB3+TDNNlriXz4lMq9C
  • TLSH
    T1C2F302B341F48266CAF9F4F66D6EE3400BE5F11BAF67895D04EC9860BC7509980F22B4
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  bazaraicredential_accessdefense_evasiondiscoveryexecutiondestiny_stealerremcosxwormpersistenceratspywarestealertrojansuricata

  • Detect Xworm Payload

  • Family: Destiny Stealer

    DestinyStealer is a stealer written in C#.

    stealerdestiny_stealer

  • Family: Remcos

    Remcos is a closed-source remote control and surveillance software.

    ratremcos

  • Family: Xworm

    Xworm is a remote access trojan written in C#.

    trojanratxworm

  • Suricata alert: REMCOS RAT Malware Inbound C2 Communication

    Network activity triggered a Suricata alert

    suricataremcos

  • Suricata alert: REMCOS RAT Malware Outbound C2 Communication

    Network activity triggered a Suricata alert

    suricataremcos

  • Detected Nirsoft tools

    Free utilities often used by attackers which can steal passwords, product keys, etc.

  • NirSoft EdgeCookiesView

    Password recovery tool for Microsoft Edge browser

  • NirSoft WebBrowserPassView

    Password recovery tool for various web browsers

  • Adds policy Run key to start application

    persistence

  • Command and Scripting Interpreter: PowerShell

    Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

    execution

  • Uses browser remote debugging

    Can be used control the browser and steal sensitive information such as credentials and session cookies.

    credential_accessstealer

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Drops startup file

  • Executes dropped EXE

  • Loads dropped DLL

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Adds Run key to start application

    persistence

  • Deobfuscate/Decode Files or Information

    Payload decoded via CertUtil.

    defense_evasion

  • Suspicious use of SetThreadContext

  behavioral1behavioral2