Extracted

• • Target
    FP 132573462346204_11_2025_MAGNoncoalescing.bat
  • Size 6KB
  • SHA256 d3176f06025bb66fda5faa1cf365dc69febf937e1a725e624e7010eb3fed27fd
  • MD5 29bf4ab1f479b2e93a15ee35d73da8ac
  • SHA1 9ed8d14e91c22fa729ed2301f3a3941c39fff6bf
  • SHA512 ba6e8e693b9d972ecb574f438a8d0bea43dd9529ab7b990f4d631cfeb22d6dd79d2ee22155cd35460e64003c5d33bd4379033c203e31f2024412c9fe67b328fb
  • SSDEEP 192:PItmX+wHilMOu0wu2mlMFa404bO074QPy3:P8y+wGQ0wNml6BZbXE
  • MD5 SHA1 SHA512 SSDEEP

  Score

  10^/10

  bamboocollectiondiscoverydownloaderexecutionguloaderremcospersistenceratdefense_evasiontrojan

  • Guloader family

    guloader

  • Guloader,Cloudeye

    A shellcode based downloader first seen in 2020.

    downloaderguloader

  • Remcos

    Remcos is a closed-source remote control and surveillance software.

    ratremcos

  • Remcos family

    remcos

  • UAC bypass

    defense_evasiontrojan

  • Detected Nirsoft tools

    Free utilities often used by attackers which can steal passwords, product keys, etc.

  • NirSoft MailPassView

    Password recovery tool for various email clients

  • NirSoft WebBrowserPassView

    Password recovery tool for various web browsers

  • Badlisted process makes network request

    Network request originating from process or tool commonly abused by malware.

  • Command and Scripting Interpreter: PowerShell

    Run Powershell and hide display window.

    execution

  • Accesses Microsoft Outlook accounts

    collection

  • Adds Run key to start application

    persistence

  • Drops file in System32 directory

  • Suspicious use of NtCreateThreadExHideFromDebugger

  • Suspicious use of NtSetInformationThreadHideFromDebugger

  • Suspicious use of SetThreadContext

  behavioral1behavioral2