Extracted

• • Target
    47628bf5d571084ccd174e03c02efb2e2211b69d88a12445829344b1cdeea945.bin
  • Size 434KB
  • SHA256 47628bf5d571084ccd174e03c02efb2e2211b69d88a12445829344b1cdeea945
  • MD5 d7430596c7d09fd39ab638f7d2cc40a0
  • SHA1 1e21225571a98edbfd9c41c530f13855fe1b20dd
  • SHA512 7da932abcf2995e101ff5fe408831c1b56182595e20802a2e5fa828676a39a26aface47800066678e874090a2f62ac2522391bf6fda2984ddb20e33bf93049f5
  • SSDEEP 12288:8We+w9v/m7JkOMNyo2xyybdkoehqksNKH:/eB3m7JkOOFEnZteEksgH
  • TLSH
    T1A0945B20ED34067D0F471BA9FCE50B62CABD8619463650F5F6DA030E61069FCE3BE669
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  channelsdefense_evasiondiscoverydownloaderexecutionguloaderremcosprivilege_escalationratcollectionpersistence

  • Family: Guloader,Cloudeye

    A shellcode based downloader first seen in 2020.

    downloaderguloader

  • Family: Remcos

    Remcos is a closed-source remote control and surveillance software.

    ratremcos

  • Process spawned unexpected child process

    This typically indicates the parent process was compromised via an exploit or macro.

  • Badlisted process makes network request

    Network request originating from process or tool commonly abused by malware.

  • Accesses Microsoft Outlook profiles

    collection

  • Adds Run key to start application

    persistence

  • Enumerates connected drives

    Attempts to read the root path of hard drives other than the default C: drive.

  • Drops file in System32 directory

  • Suspicious use of NtCreateThreadExHideFromDebugger

    defense_evasion

  • Suspicious use of NtSetInformationThreadHideFromDebugger

    defense_evasion
  behavioral1behavioral2