flash

SBG-1100319PurchaseOrder.exe

Status: finished
Submission Time: 15.04.2021 21:36:29
Malicious
Ransomware
Trojan
Spyware
Evader
Remcos GuLoader

Comments

Tags

  • exe
  • RAT
  • RemcosRAT

Details

  • Analysis ID:
    388089
  • API (Web) ID:
    678273
  • Analysis Started:
    15.04.2021 21:36:31
  • Analysis Finished:
    15.04.2021 21:45:15
  • MD5:
    2dd62d78b9f7e9c5529502e085b55756
  • SHA1:
    151d4cd68958df35ae706cc232627a05e923307f
  • SHA256:
    c63a3f86be406a11e8f7760403e407a97441753205f8cef432fd634856ca2992
  • Technologies:
Full Report Management Report IOC Report Engine Info Verdict Score Reports

System: Windows 10 64 bit v1803 with Office Professional Plus 2016, Chrome 85, IE 11, Adobe Reader DC 19, Java 8 Update 211

malicious
100/100

IPs

IP Country Detection
79.134.225.124
Switzerland

Domains

Name IP Detection
sheilabeltagy4m.hopto.org
79.134.225.124
micheal3m.hopto.org
79.134.225.124
onedrive.live.com
0.0.0.0
Click to see the 1 hidden entries
vug8la.am.files.1drv.com
0.0.0.0

URLs

Name Detection
https://onedrive.live.com/b
https://vug8la.am.files.1drv.com/y4mT1QYIp_fyTE8Fy0lLLYF_0s99rPZfbzgWA1b5QlZt4eQwn4RVNktZv9qdlLB64Ai
https://onedrive.live.com/download?cid=1685231EC8E4EC43&resid=1685231EC8E4EC43%21505&authkey=ANKqoxx
Click to see the 3 hidden entries
https://vug8la.am.files.1drv.com/
https://onedrive.live.com/
https://onedrive.live.com/download?cid=1685231EC8E4EC43&resid=1685231EC8E4EC43%2

Dropped files

Name File Type Hashes Detection
C:\Users\user\AppData\Local\Temp\subfolder1\filename1.exe
PE32 executable (GUI) Intel 80386, for MS Windows
#
C:\Users\user\AppData\Local\Temp\subfolder1\filename1.vbs
ASCII text, with CRLF line terminators
#
C:\Users\user\AppData\Roaming\remcos\logs.dat
data
#