General
- Target Rfq_last_quater_product_purchase_order_import_list_2024_000000.cmd
- Size 4KB
- Sample240902-jhdgcawfpf
- SHA256 a16e6ab8d42469af04bbab862b8676b048cd5a597c4bd2691e604ff36b532958
Score
10/10
Malware Config
Targets
-
- Target Rfq_last_quater_product_purchase_order_import_list_2024_000000.cmd
- Size 4KB
- SHA256 a16e6ab8d42469af04bbab862b8676b048cd5a597c4bd2691e604ff36b532958
Score10/10Guloader,Cloudeye
A shellcode based downloader first seen in 2020.
Credentials from Password Stores: Credentials from Web Browsers
Malicious Access or copy of Web Browser Credential store.
Detected Nirsoft tools
Free utilities often used by attackers which can steal passwords, product keys, etc.
NirSoft MailPassView
Password recovery tool for various email clients
NirSoft WebBrowserPassView
Password recovery tool for various web browsers
Blocklisted process makes network request
Command and Scripting Interpreter: PowerShell
Run Powershell and hide display window.
Command and Scripting Interpreter: PowerShell
Using powershell.exe command.
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
Accesses Microsoft Outlook accounts
Adds Run key to start application
Suspicious use of NtCreateThreadExHideFromDebugger
Suspicious use of NtSetInformationThreadHideFromDebugger
Suspicious use of SetThreadContext