Extracted

• • Target
    20dbcab2dc3f9e4ec9a7d55876b536fa1fcc5f6dc00f6181b5cff7c9338f45c9.exe
  • Size 467KB
  • SHA256 20dbcab2dc3f9e4ec9a7d55876b536fa1fcc5f6dc00f6181b5cff7c9338f45c9
  • MD5 2f426d2fb00858d8649cf99eb2e2aac6
  • SHA1 d234740fdb4a0860d18bae49d82827bef3dd28b1
  • SHA512 1dd5459abc43992bbf2ab11ab4da1895b3dd6ec710ebefe90c88c5957bd82a15924fac57360ac59c2dc5746bcd6b80aba5eafb7e5eff24719404ecccdfdd885d
  • SSDEEP 6144:7XsKoGShOkrI7LtxQ+/yqAkx9xjb0SNEhIXpjdWBP4L:7XOeUEp0SahIXeBP4L
  • TLSH
    T12EA48D41F8149CE6F8395672687F8DB609E13D3B46E019AE27DFB37A14F2212501BE1E
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  sendersdiscoverydownloaderguloaderremcospersistenceratsuricata

  • Family: Guloader,Cloudeye

    A shellcode based downloader first seen in 2020.

    downloaderguloader

  • Family: Remcos

    Remcos is a closed-source remote control and surveillance software.

    ratremcos

  • Suricata alert: REMCOS RAT Malware Inbound C2 Communication

    Network activity triggered a Suricata alert

    suricataremcos

  • Suricata alert: REMCOS RAT Malware Outbound C2 Communication

    Network activity triggered a Suricata alert

    suricataremcos

  • Loads dropped DLL

  • Adds Run key to start application

    persistence

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery

  • Contacts third-party web service commonly abused for C2

    Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.

  • Drops file in System32 directory

  • Suspicious use of NtCreateThreadExHideFromDebugger

  • Suspicious use of NtSetInformationThreadHideFromDebugger

  behavioral1behavioral2
• • Target
    $PLUGINSDIR/System.dll
  • Size 12KB
  • SHA256 23d618a0293c78ce00f7c6e6dd8b8923621da7dd1f63a070163ef4c0ec3033d6
  • MD5 192639861e3dc2dc5c08bb8f8c7260d5
  • SHA1 58d30e460609e22fa0098bc27d928b689ef9af78
  • SHA512 6e573d8b2ef6ed719e271fd0b2fd9cd451f61fc9a9459330108d6d7a65a0f64016303318cad787aa1d5334ba670d8f1c7c13074e1be550b4a316963ecc465cdc
  • SSDEEP 192:ljHcQ0qWTlt7wi5Aj/lM0sEWD/wtYbBjpNQybC7y+XZqE0QPi:R/Qlt7wiij/lMRv/9V4bfr
  • TLSH
    T1B1427C1297B089F2F551493419667F2A6FBEAC5C13F405A3CFE304C63D212CB9839243
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  3^/10

  discovery
  behavioral3behavioral4