Extracted

• • Target
    Statement of Account for April.bat
  • Size 381KB
  • SHA256 0311761bca1187e06281040ec3141356fb1008446adaeaa0b2ed311918bf003f
  • MD5 527b885d4995f35626cce5bc24a46a1c
  • SHA1 5a4e5dfb9855d2449cf27f724b417233f1597f3d
  • SHA512 31e07d13cddc696ccf5bb91f1e90af5ae97a4dc764dd10ac9b00f5b3d4925a80a788a5a7394a1d9996091e00e4b1363a7f53e4a4a12021ec70ec8deac53c4f2c
  • SSDEEP 6144:a4t6LsCB7fXyMBDmJ2wYL+jZ6Cl5MxDt36tgbWg7XgmRUaoVb4s4ggqER:akCBLXy8m2WUCEx8Xgbgme/9cR
  • TLSH
    T1448412127EA1C423C1795272CD2AD6F975289DF8EB6E8F0F1F903E6DB8B16524D04349
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  hradiscoverydownloaderguloaderremcospersistenceratcredential_accessdefense_evasionspywarestealertrojan

  • Family: Guloader,Cloudeye

    A shellcode based downloader first seen in 2020.

    downloaderguloader

  • Family: Remcos

    Remcos is a closed-source remote control and surveillance software.

    ratremcos

  • UAC bypass

    defense_evasiontrojan

  • Detected Nirsoft tools

    Free utilities often used by attackers which can steal passwords, product keys, etc.

  • Uses browser remote debugging

    Can be used control the browser and steal sensitive information such as credentials and session cookies.

    credential_accessstealer

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Adds Run key to start application

    persistence

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery

  • Contacts third-party web service commonly abused for C2

    Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.

  • Drops file in System32 directory

  • Suspicious use of NtCreateThreadExHideFromDebugger

  • Suspicious use of NtSetInformationThreadHideFromDebugger

  • Suspicious use of SetThreadContext

  behavioral1behavioral2
• • Target
    $PLUGINSDIR/System.dll
  • Size 11KB
  • SHA256 bd046e6497b304e4ea4ab102cab2b1f94ce09bde0eebba4c59942a732679e4eb
  • MD5 17ed1c86bd67e78ade4712be48a7d2bd
  • SHA1 1cc9fe86d6d6030b4dae45ecddce5907991c01a0
  • SHA512 0cbed521e7d6d1f85977b3f7d3ca7ac34e1b5495b69fd8c7bfa1a846baf53b0ecd06fe1ad02a3599082ffacaf8c71a3bb4e32dec05f8e24859d736b828092cd5
  • SSDEEP 192:eY24sihno00Wfl97nH6T2enXwWobpWBTU4VtHT7dmN35Ol+Sl:E8QIl975eXqlWBrz7YLOl+
  • TLSH
    T1E3325C12135081F3E4918138C86B3A276B6A15029BF98E57DFD39546BE31BE3BD7D603
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  3^/10

  discovery
  behavioral3behavioral4