Extracted

• • Target
    Construcciones CAMSA S.L. REQ2060026.bat
  • Size 4KB
  • SHA256 9c45728ef269de5f7b84f2802775d15ef8c1f89b59d01e75fe6239e8720c38d8
  • MD5 457a490b953f63779d55f3e006782494
  • SHA1 6e01cfb35e0c3c996e8f5b96e17bd7163479daa1
  • SHA512 3ab7d1d41b6b55d33a25913ef490f8bd4273d179668dfbfd65b53c3a6224837992bd9a3721afebeab9a23a1c7cdaa3753dd2c1bc1e591971b65c6b5954f9bf8d
  • SSDEEP 96:4HD8JTFLAgXRVdFh/OIQIqp2m8tWNAJWyRJg3kn:uWZL5Vd3/apLzsWyU3k
  • TLSH
    T11C913AAA4F12C8EB8F2A0998DD5E2FE628051BBB013454599336F359615DC93823BC97
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  discoverydownloaderexecutionguloadervipkeyloggerkeyloggerstealer

  • Family: Guloader,Cloudeye

    A shellcode based downloader first seen in 2020.

    downloaderguloader

  • Family: VIPKeylogger

    VIPKeylogger is a keylogger and infostealer written in C# and it resembles SnakeKeylogger that was found in 2020.

    stealerkeyloggervipkeylogger

  • Badlisted process makes network request

    Network request originating from process or tool commonly abused by malware.

  • Contacts third-party web service commonly abused for C2

    Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Suspicious use of NtCreateThreadExHideFromDebugger

  • Suspicious use of NtSetInformationThreadHideFromDebugger

  behavioral1behavioral2