Extracted

• • Target
    TransEuropeasia.exe
  • Size 402KB
  • SHA256 ced82528b08a52a9a0aaaffdeda31641897e0973685562506f88674a3da1cf98
  • MD5 31cb90122f3cb468a792693578dd3531
  • SHA1 84aae9bc3eeae8cf4c966d24bb947e8418a5d5c8
  • SHA512 fe3c35a06622f69a18c01342747458828c33384ffd26c457c16de8e66edfcb924244a45740a530c6bfd643a895bfd8db57ffd03756dce47c4e64751fd5b3e25e
  • SSDEEP 6144:I4t6LsCB7fXyMBDmJzy7bAz3fCAq4YSRFF4s2yAGHOrGHKRuJrDA5Dpd93b9xW:IkCBLXy8mzyovHpRUQnHOrGqRudeTXxW
  • TLSH
    T10E9402023F84D447C6B91272ED19E9FAB1694EF0DB6E4E1F0F90BD9CB8B56550A0C31A
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  remotehostcollectiondiscoveryremcospersistencerat

  • Family: Remcos

    Remcos is a closed-source remote control and surveillance software.

    ratremcos

  • Detected Nirsoft tools

    Free utilities often used by attackers which can steal passwords, product keys, etc.

  • NirSoft MailPassView

    Password recovery tool for various email clients

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Accesses Microsoft Outlook accounts

    collection

  • Adds Run key to start application

    persistence

  • Contacts third-party web service commonly abused for C2

    Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.

  • Drops file in System32 directory

  • Suspicious use of NtCreateThreadExHideFromDebugger

  • Suspicious use of NtSetInformationThreadHideFromDebugger

  • Suspicious use of SetThreadContext

  behavioral1behavioral2
• • Target
    $PLUGINSDIR/System.dll
  • Size 11KB
  • SHA256 bd046e6497b304e4ea4ab102cab2b1f94ce09bde0eebba4c59942a732679e4eb
  • MD5 17ed1c86bd67e78ade4712be48a7d2bd
  • SHA1 1cc9fe86d6d6030b4dae45ecddce5907991c01a0
  • SHA512 0cbed521e7d6d1f85977b3f7d3ca7ac34e1b5495b69fd8c7bfa1a846baf53b0ecd06fe1ad02a3599082ffacaf8c71a3bb4e32dec05f8e24859d736b828092cd5
  • SSDEEP 192:eY24sihno00Wfl97nH6T2enXwWobpWBTU4VtHT7dmN35Ol+Sl:E8QIl975eXqlWBrz7YLOl+
  • TLSH
    T1E3325C12135081F3E4918138C86B3A276B6A15029BF98E57DFD39546BE31BE3BD7D603
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  3^/10

  discovery
  behavioral3behavioral4