Overview

overview

9

Static

static

3

RemoFOR_v26.10.5.exe

windows10-ltsc_2021-x64

Sharing

Copy URL Twitter E-mail

General

  • Target
    RemoFOR_v26.10.5.exe
  • Size 42.6MB
  • Sample260730-ncn34szwft
  • SHA256 df21d6a2e845db1f3b284093d4825790bd9dec9bc0ade601fdc74ec57cb9bbad
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
9/10
microsoftcosturadefense_evasiondiscoveryexecutionpackerpersistencephishingpyinstallerspywaretrojanupx

Malware Config

Targets

    • Target
      RemoFOR_v26.10.5.exe
    • Size 42.6MB
    • SHA256 df21d6a2e845db1f3b284093d4825790bd9dec9bc0ade601fdc74ec57cb9bbad
    • MD5 SHA1 SHA512 SSDEEP TLSH
    Score
    9/10
    microsoftcosturadefense_evasiondiscoveryexecutionpackerpersistencephishingpyinstallerspywaretrojanupx

    • Detected Nirsoft tools

      Free utilities often used by attackers which can steal passwords, product keys, etc.

    • Sets service image path in registry

      This determines the executable launched when a service starts. It can be used to establish persistence.

      persistence

    • A potential corporate email address has been identified in the URL: [email protected]

      phishing

    • Executes dropped EXE

    • Loads dropped DLL

    • Drops desktop.ini file(s)

    • Detected potential entity reuse from brand MICROSOFT.

      phishingmicrosoft

    • Probable phishing domain

    • UPX packed file

      Detects executables packed with UPX/modified UPX open source packer.

      upx
    behavioral1

MITRE ATT&CK Enterprise v16

Tasks