Extracted

• • Target
    papegjenbets.exe
  • Size 512KB
  • SHA256 4a5091bff9c03a4944d380d9964554c163fc69b3cf06d32ec50bd8c9b222904c
  • MD5 a29169edead08599bdf754075c1784a5
  • SHA1 c5c1495cabdae4e0bfd4574302a4cfb6575403a8
  • SHA512 e0de56d56907f5e428534b02c9e22b8f7eed8375ea2478e83e2b34372ebb78799adeb7971e011dbbaa04b8c4a4fd1fa56b71170a1b3987b6ef7b6a1bed2d8545
  • SSDEEP 6144:3Y6yrJQqJOBcDouYvuh0YoKQ8t4HHt1SacHWKMs+az8K0qZICA2+j8tbp4frFagy:3BQEiuvu20Q8yHN1LeQ9qqCygkfrw
  • TLSH
    T1CDB41204FFC6E8E9D479C53446B6D2A36431BD9D5939B60F63287E2F7D70980D93A204
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  jesus christcollectioncredential_accessdiscoveryremcosratspywarestealeradwarepersistence

  • Family: Remcos

    Remcos is a closed-source remote control and surveillance software.

    ratremcos

  • Boot or Logon Autostart Execution: Active Setup

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

    persistence

  • Uses browser remote debugging

    Can be used control the browser and steal sensitive information such as credentials and session cookies.

    credential_accessstealer

  • Loads dropped DLL

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Accesses Microsoft Outlook profiles

    collection

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery

  • Enumerates connected drives

    Attempts to read the root path of hard drives other than the default C: drive.

  • Suspicious use of NtSetInformationThreadHideFromDebugger

  • Suspicious use of SetThreadContext

  behavioral1behavioral2
• • Target
    $PLUGINSDIR/System.dll
  • Size 25KB
  • SHA256 c7dd8cc8323e295b8821b0e320de208a7e20c068a8be8d03857520451ce9ded7
  • MD5 4abf19a47044ec746aa8c600f0bc149f
  • SHA1 69da1e4f654b044d7b3c845c12a07c988bf26eb8
  • SHA512 65727cbe3f03e0dceba06d206054e60adba321d29159b4bfb690c30b2ccd1a0a05a08c2aa50ac270fcd28557f4b482f492c36b0d7b7b980b477cd8971559610e
  • SSDEEP 384:jZ2pfUx9eVLwDKO9XYD/isN7lCEjgwMU/ktKi+R45Duwomq8pqdDvH81Q:jr96YIrx7lC7vU/kaG9uLmCdb
  • TLSH
    T1DEB24C07F38398BFC51BC17186EF5772AA32BE211B616F6F1220F5756E24EA0871DA14
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  1^/10
  behavioral3behavioral4
• • Target
    $PLUGINSDIR/nsDialogs.dll
  • Size 14KB
  • SHA256 a0a6431feb4e09018d99acdc02f2139fbacd68420b0f84d4b22a9e091aaac707
  • MD5 48452d7f73a0e73b62a16b4c88068a60
  • SHA1 ef5a3edd25cf3cf664e93c38fbe9034ce652d117
  • SHA512 83dae4699678c2eb245bb3a5758b9decdae308042bf50a36266222a9c20f197503baad9f58f2522c6bfe32ad62b8af6ab6b8f99f2e51b72383f6c50d4d699274
  • SSDEEP 192:PZWhF6MuqMgfdPvg/YWkNLiY8vSKXS6Hn5gIIblaks8NHAHPEdeqe4KFz0:hWh4MFv1w/YWCLXASKi6nAlHJAl4KW
  • TLSH
    T13852191B7B42962ACD0AE374D5EF573322F3F4551138370E0669DB49BFE1660DA39288
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  1^/10
  behavioral5behavioral6