Extracted

• • Target
    0fbc7664bfc893f983376909f8df30b964d4b8b78934aa42e8e966670d3cf391.exe
  • Size 585KB
  • SHA256 0fbc7664bfc893f983376909f8df30b964d4b8b78934aa42e8e966670d3cf391
  • MD5 5ff02f584e5e933c8c0f875df3787ea4
  • SHA1 cba53711a8ba1e224028773b3e1c3f283792fe36
  • SHA512 ad2aac220d5ef875c2a0d01461df4956e87ffd5f7b0d46b172643b36feb386dacaf356aafdd0ae5149872e061a651edbd6a2b0d15e1d12e6196db295feb1b3d4
  • SSDEEP 6144:oYa6eJsYMZ4YdvJe+vT9pr0FV7gH7Ehpuv9w7GeY5momtygSyq6WKFVfR5N59Zt4:oYEJsB4YxvP4kH99aks/ybyhWKLNzZO
  • TLSH
    T17AD4A02564014041CA0F1F71B16D97A67963BFBA287CF22E6A3AFBD522F72C2D13614D
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  remotehostdiscoverydownloaderguloaderremcospersistencerat

  • Family: Guloader,Cloudeye

    A shellcode based downloader first seen in 2020.

    downloaderguloader

  • Family: Remcos

    Remcos is a closed-source remote control and surveillance software.

    ratremcos

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Adds Run key to start application

    persistence

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery

  • Contacts third-party web service commonly abused for C2

    Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.

  • Suspicious use of NtCreateThreadExHideFromDebugger

  • Suspicious use of NtSetInformationThreadHideFromDebugger

  behavioral1behavioral2
• • Target
    $PLUGINSDIR/System.dll
  • Size 12KB
  • SHA256 8dc562cda7217a3a52db898243de3e2ed68b80e62ddcb8619545ed0b4e7f65a8
  • MD5 cff85c549d536f651d4fb8387f1976f2
  • SHA1 d41ce3a5ff609df9cf5c7e207d3b59bf8a48530e
  • SHA512 531d6328daf3b86d85556016d299798fa06fefc81604185108a342d000e203094c8c12226a12bd6e1f89b0db501fb66f827b610d460b933bd4ab936ac2fd8a88
  • SSDEEP 192:Zjvco0qWTlt70m5Aj/lQ0sEWD/wtYbBHFNaDybC7y+XBz0QPi:FHQlt70mij/lQRv/9VMjzr
  • TLSH
    T126426B129BB089F2F591583814667F2A6FBE9C5D27F50563CFE304D63D212CB983A283
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  3^/10

  discovery
  behavioral3behavioral4
• • Target
    $PLUGINSDIR/nsDialogs.dll
  • Size 9KB
  • SHA256 56b96add1978b1abba286f7f8982b0efbe007d4a48b3ded6a4d408e01d753fe2
  • MD5 6c3f8c94d0727894d706940a8a980543
  • SHA1 0d1bcad901be377f38d579aafc0c41c0ef8dcefd
  • SHA512 2094f0e4bb7c806a5ff27f83a1d572a5512d979eefda3345baff27d2c89e828f68466d08c3ca250da11b01fc0407a21743037c25e94fbe688566dd7deaebd355
  • SSDEEP 96:o0svUu3Uy+sytcS8176b+XR8pCHFcMcxSgB5PKtAtgt+Nt+rnt3DVEB3YcNqkzfS:o0svWyNO81b8pCHFcM0PuAgkOyuIFc
  • TLSH
    T17012F992E6A450B3C5D6533B35AA2F2DCBBD5325B0926C00C7738E4D39395B66E38353
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  3^/10

  discovery
  behavioral5behavioral6