Extracted

• • Target
    e12cd39fe463913671dfd1d1e2d927f26d50fe6cf5a20f6aaeb7fcc11a42b1b6
  • Size 525KB
  • SHA256 e12cd39fe463913671dfd1d1e2d927f26d50fe6cf5a20f6aaeb7fcc11a42b1b6
  • MD5 536cc9ae048a244e0c2fac3fc5d834b8
  • SHA1 cd7a7d0776467ff861f11e8a3c452c360eb434a1
  • SHA512 2423255d4301af02976def58cce3a5ead3f8fa9e2cabfba00d9ace4d9ce3f940df62a7685cce4618018648718fe7cc7d74ed4e85f8eb98c53f76a1c62fe088e0
  • SSDEEP 12288:sBQEitvu2+Pz/mIoOhdY+o1a7rdBfLfo4F5Cl9kfr:sBet9+b/ldYt47rd5fzu
  • TLSH
    T1B9B41200FF8668E9D8BAC5719AB7A5622431BEDC1829B71F53287E6F3D30D50C93A705
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  jesus christcollectioncredential_accessdiscoveryremcosratspywarestealer

  • Family: Remcos

    Remcos is a closed-source remote control and surveillance software.

    ratremcos

  • Uses browser remote debugging

    Can be used control the browser and steal sensitive information such as credentials and session cookies.

    credential_accessstealer

  • Loads dropped DLL

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Accesses Microsoft Outlook profiles

    collection

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery

  • Suspicious use of NtSetInformationThreadHideFromDebugger

  • Suspicious use of SetThreadContext

  behavioral1behavioral2
• • Target
    $PLUGINSDIR/System.dll
  • Size 25KB
  • SHA256 c7dd8cc8323e295b8821b0e320de208a7e20c068a8be8d03857520451ce9ded7
  • MD5 4abf19a47044ec746aa8c600f0bc149f
  • SHA1 69da1e4f654b044d7b3c845c12a07c988bf26eb8
  • SHA512 65727cbe3f03e0dceba06d206054e60adba321d29159b4bfb690c30b2ccd1a0a05a08c2aa50ac270fcd28557f4b482f492c36b0d7b7b980b477cd8971559610e
  • SSDEEP 384:jZ2pfUx9eVLwDKO9XYD/isN7lCEjgwMU/ktKi+R45Duwomq8pqdDvH81Q:jr96YIrx7lC7vU/kaG9uLmCdb
  • TLSH
    T1DEB24C07F38398BFC51BC17186EF5772AA32BE211B616F6F1220F5756E24EA0871DA14
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  8^/10

  adwarepersistenceransomwarespyware

  • Boot or Logon Autostart Execution: Active Setup

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

    persistence

  • Enumerates connected drives

    Attempts to read the root path of hard drives other than the default C: drive.

  behavioral3behavioral4
• • Target
    $PLUGINSDIR/nsDialogs.dll
  • Size 14KB
  • SHA256 a0a6431feb4e09018d99acdc02f2139fbacd68420b0f84d4b22a9e091aaac707
  • MD5 48452d7f73a0e73b62a16b4c88068a60
  • SHA1 ef5a3edd25cf3cf664e93c38fbe9034ce652d117
  • SHA512 83dae4699678c2eb245bb3a5758b9decdae308042bf50a36266222a9c20f197503baad9f58f2522c6bfe32ad62b8af6ab6b8f99f2e51b72383f6c50d4d699274
  • SSDEEP 192:PZWhF6MuqMgfdPvg/YWkNLiY8vSKXS6Hn5gIIblaks8NHAHPEdeqe4KFz0:hWh4MFv1w/YWCLXASKi6nAlHJAl4KW
  • TLSH
    T13852191B7B42962ACD0AE374D5EF573322F3F4551138370E0669DB49BFE1660DA39288
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  1^/10
  behavioral5behavioral6