Extracted

• • Target
    rCM6074148603R2795244242442424253535.bat
  • Size 6KB
  • SHA256 f2ffb11a68f8c689d0df4b2f035be0d9d3aff4b3ad4c3a158741050c6948fcb7
  • MD5 54b076a681eb063ad7eca17f66f633fa
  • SHA1 6cedc59f2b8b4276ecf06f0147612e0caec416dc
  • SHA512 00b8bc05bc2f58713a0d82acee689cc06bc0ec601af75dd18058b558e60cdb96fad81ed4c4e2a0a73f7f7da60c12e5b64faa38115a9878e67e1f728f319b336d
  • SSDEEP 96:YVZbXzLYwVb6dc1NWJ4/kI7qmTmNzHKS35lhyBEc8WCLBDkYRhB55wiYiFzxt5V:YVZ/LydGG4/35To3LhyB2WCxLhTKez/D
  • MD5 SHA1 SHA512 SSDEEP

  Score

  10^/10

  bamboocollectiondiscoverydownloaderexecutionguloaderremcospersistenceratdefense_evasiontrojan

  • Guloader family

    guloader

  • Guloader,Cloudeye

    A shellcode based downloader first seen in 2020.

    downloaderguloader

  • Remcos

    Remcos is a closed-source remote control and surveillance software.

    ratremcos

  • Remcos family

    remcos

  • UAC bypass

    defense_evasiontrojan

  • Detected Nirsoft tools

    Free utilities often used by attackers which can steal passwords, product keys, etc.

  • NirSoft MailPassView

    Password recovery tool for various email clients

  • NirSoft WebBrowserPassView

    Password recovery tool for various web browsers

  • Badlisted process makes network request

    Network request originating from process or tool commonly abused by malware.

  • Command and Scripting Interpreter: PowerShell

    Run Powershell and hide display window.

    execution

  • Accesses Microsoft Outlook accounts

    collection

  • Adds Run key to start application

    persistence

  • Drops file in System32 directory

  • Suspicious use of NtCreateThreadExHideFromDebugger

  • Suspicious use of NtSetInformationThreadHideFromDebugger

  • Suspicious use of SetThreadContext

  behavioral1behavioral2