Extracted

• • Target
    4d1b8646c493d3fed46745143f84d655331efb35a908297c86efcdc90fe7cecd.exe
  • Size 764KB
  • SHA256 4d1b8646c493d3fed46745143f84d655331efb35a908297c86efcdc90fe7cecd
  • MD5 edb0ab2d9b2ab905e32a0eecc2c279b7
  • SHA1 b98fb072a62ba04f18bca7578912bf191ba170c0
  • SHA512 fcc64bb016bc88c490d87d54fb1fa6c8d3b01f2da745f3fb6a2cc593cf20b5b01ee77c821ffecf68b18b147d90f1b5371b87b8e7f8ea1b190b230ff150119aa7
  • SSDEEP 12288:j+RnUnoE12lM1yk7s4uKkxiaC8o03g32u2HNYQTUJ9Ag0RavExvwDY7ANuGFQBC5:j+IoE16Mj7s9oqg3aHNHmAlljEAGuBC5
  • TLSH
    T116F423387180542BC07047B99D377FBA929FDB25A660551743407E3EBCF1EEA882B1E9
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  remotehostdiscoverydownloaderguloaderremcospersistencerat

  • Family: Guloader,Cloudeye

    A shellcode based downloader first seen in 2020.

    downloaderguloader

  • Family: Remcos

    Remcos is a closed-source remote control and surveillance software.

    ratremcos

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Adds Run key to start application

    persistence

  • Contacts third-party web service commonly abused for C2

    Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.

  • Suspicious use of NtCreateThreadExHideFromDebugger

  • Suspicious use of NtSetInformationThreadHideFromDebugger

  behavioral1behavioral2
• • Target
    $PLUGINSDIR/System.dll
  • Size 12KB
  • SHA256 8b4c47c4cf5e76ec57dd5a050d5acd832a0d532ee875d7b44f6cdaf68f90d37c
  • MD5 9b38a1b07a0ebc5c7e59e63346ecc2db
  • SHA1 97332a2ffcf12a3e3f27e7c05213b5d7faa13735
  • SHA512 26e77f8e10f6d8693c92bd036b53a3f6e0c523090ef8dfe479815f556ecd2b57fc90ce9f7cceebe70460d464decb27ad1fe240819fd56997764e96506b6a439c
  • SSDEEP 192:kjHcQ0qWTlt7wi5Aj/lM0sEWD/wtYbBjpNQybC7y+XZ40QPi:U/Qlt7wiij/lMRv/9V4b4r
  • TLSH
    T1E8427C1297B089F2F151093419667F2A6FBEAC5D17F405A3CFE304C63D212CB9839243
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  3^/10

  discovery
  behavioral3behavioral4