Extracted

• • Target
    319b75ccfd07cc7aaed69cd1e1363846480ef7b8ee532f0cc13e7631c1bfae9a.exe
  • Size 413KB
  • SHA256 319b75ccfd07cc7aaed69cd1e1363846480ef7b8ee532f0cc13e7631c1bfae9a
  • MD5 ce163245770bfa3d5e039aa2bf5b44ff
  • SHA1 465fbb6d799dadc8a851e76b325649bed61818d9
  • SHA512 d5d7dcdd6dcde7553f99fd17e2b35aeaef050e8b6bc1654c8064084e41dd983ab43db4f5e9407ab31dcceacf5027fccb0a38eca36b4658d22b5f397ee2cbeb37
  • SSDEEP 6144:spkXGhE4TrIg1+MoMRAjKOvF72AJOufkPYrz90hY0YPOOHSZX:JiTrIg1+eaj57kPY/OWrOOyZX
  • TLSH
    T17294F1883F68ED0BD5E48C344DB4FA2B92B89DA04D87B702DB623D4CBD397C47949616
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  remotehostdiscoverydownloaderguloaderremcosrat

  • Family: Guloader,Cloudeye

    A shellcode based downloader first seen in 2020.

    downloaderguloader

  • Family: Remcos

    Remcos is a closed-source remote control and surveillance software.

    ratremcos

  • Loads dropped DLL

  • Contacts third-party web service commonly abused for C2

    Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.

  • Suspicious use of NtCreateThreadExHideFromDebugger

  • Suspicious use of NtSetInformationThreadHideFromDebugger

  behavioral1behavioral2
• • Target
    $PLUGINSDIR/System.dll
  • Size 11KB
  • SHA256 2e226715419a5882e2e14278940ee8ef0aa648a3ef7af5b3dc252674111962bc
  • MD5 a4dd044bcd94e9b3370ccf095b31f896
  • SHA1 17c78201323ab2095bc53184aa8267c9187d5173
  • SHA512 87335a43b9ca13e1300c7c23e702e87c669e2bcf4f6065f0c684fc53165e9c1f091cc4d79a3eca3910f0518d3b647120ac0be1a68eaade2e75eaa64adfc92c5a
  • SSDEEP 192:em24sihno00Wfl97nH6T2enXwWobpWBTU4VtHT7dmN35OlESl:m8QIl975eXqlWBrz7YLOlE
  • TLSH
    T168325C12135081F3E4918138886B3A276B6A15029BF98E57DFD39646BE21BE3BD7D603
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  8^/10

  discoveryadwarepersistencespyware

  • Boot or Logon Autostart Execution: Active Setup

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

    persistence

  • Enumerates connected drives

    Attempts to read the root path of hard drives other than the default C: drive.

  behavioral3behavioral4