Extracted

• • Target
    d6859252ceb119bb7e3006ee987cc146160d4ad03b682fb06b063d55946971b3.exe
  • Size 408KB
  • SHA256 d6859252ceb119bb7e3006ee987cc146160d4ad03b682fb06b063d55946971b3
  • MD5 02ad4879bb3f0d45a51fa53bef6eace0
  • SHA1 74980e309307686e5231f03d0e5e5d1b5d86a7fb
  • SHA512 cd1c9bf0c8ff0337cfef3e7eafbf345cc92c31366b660b9f83a8cdb4536c4187445fb8b6ff1bca2289932f767023ca2736f14301940284d53e6e401ffa8a5757
  • SSDEEP 12288:jiTrIg1+eaj57O0lHzzdANHQHybSq2/ZH:WogY5OSHzzOJQSOqSZH
  • TLSH
    T14A94E1897F6CED0BE6958C304DB4FA2B91B95DA08E87AB02DF223D0C7D393C47A09555
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  remotehostdiscoveryremcosrat

  • Family: Remcos

    Remcos is a closed-source remote control and surveillance software.

    ratremcos

  • Loads dropped DLL

  • Contacts third-party web service commonly abused for C2

    Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.

  • Suspicious use of NtCreateThreadExHideFromDebugger

  • Suspicious use of NtSetInformationThreadHideFromDebugger

  behavioral1behavioral2
• • Target
    $PLUGINSDIR/System.dll
  • Size 11KB
  • SHA256 2e226715419a5882e2e14278940ee8ef0aa648a3ef7af5b3dc252674111962bc
  • MD5 a4dd044bcd94e9b3370ccf095b31f896
  • SHA1 17c78201323ab2095bc53184aa8267c9187d5173
  • SHA512 87335a43b9ca13e1300c7c23e702e87c669e2bcf4f6065f0c684fc53165e9c1f091cc4d79a3eca3910f0518d3b647120ac0be1a68eaade2e75eaa64adfc92c5a
  • SSDEEP 192:em24sihno00Wfl97nH6T2enXwWobpWBTU4VtHT7dmN35OlESl:m8QIl975eXqlWBrz7YLOlE
  • TLSH
    T168325C12135081F3E4918138886B3A276B6A15029BF98E57DFD39646BE21BE3BD7D603
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  8^/10

  discoveryadwarepersistenceransomwarespyware

  • Boot or Logon Autostart Execution: Active Setup

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

    persistence

  • Enumerates connected drives

    Attempts to read the root path of hard drives other than the default C: drive.

  behavioral3behavioral4