Extracted

Extracted

• • Target
    c4703b84c3c69c969924ba2d14c380a5473a5617caecee07147f36a1196d194c.bin
  • Size 232KB
  • SHA256 c4703b84c3c69c969924ba2d14c380a5473a5617caecee07147f36a1196d194c
  • MD5 649742a76967ffe14a5ee397e8e2d0c0
  • SHA1 55e41ac7a40107c3cd514a3652b182f9834161bf
  • SHA512 96969a225cbc867e4621134503cca3e43158dfe2fb4f047cccb01f160479d2b7a80b6306e6a4fa1e5a64c41305d70def2754905325472ad8a8548f95f50eb3cd
  • SSDEEP 1536:BZvrmLrtqqBR0f1fjdX/pQIGm8jNwpcTeSWTgd8MEcwntU8NVmdQ2oZ9WjRYHbMz:BZvaP8I0fRZXxkacTATjMENXVBtW2K
  • TLSH
    T174344FB6138003BAE2D04BD0411CB25B06F6D56A7464398DEFF359AFBD29EA33438576
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  remotehostcollectioncredential_accessdefense_evasiondiscoveryexecutionremcosxwormpersistenceprivilege_escalationratspywarestealertrojan

  • Detect Xworm Payload

  • Family: Remcos

    Remcos is a closed-source remote control and surveillance software.

    ratremcos

  • Family: Xworm

    Xworm is a remote access trojan written in C#.

    trojanratxworm

  • UAC bypass

    defense_evasiontrojan

  • Adds policy Run key to start application

    persistence

  • Uses browser remote debugging

    Can be used control the browser and steal sensitive information such as credentials and session cookies.

    credential_accessstealer

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Creates a file in the Startup directory

    A file was written to a Windows startup folder. Files in these directories are executed automatically when a user logs on or an application initializes.

    persistenceprivilege_escalation

  • Executes dropped EXE

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Accesses Microsoft Outlook profiles

    collection

  • Adds Run key to start application

    persistence

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery

  • ConfuserEx .NET packer

    Detects ConfuserEx .NET packer.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2