General
- Target 09062026_1503_08062026_Pedido de Cotação-20260608_Mapa de Quantidades_Lista Comercial_pdf.rar
- Size 2KB
- Sample260609-sfc78sds9j
- SHA256 d55cf80192d220296a9c5a196944e6142e80705acfa1429d6884860d088545bf
Score
10/10
Malware Config
Targets
-
- Target Pedido de Cotação-20260608_Mapa de Quantidades_Lista Comercial_pdf.bat
- Size 4KB
- SHA256 034909b8c980a4c3c677aa7f7ea86389d8c4b59629ed9ae868c9587898c94409
Score10/10-
Family: Guloader,Cloudeye
A shellcode based downloader first seen in 2020.
-
Badlisted process makes network request
Network request originating from process or tool commonly abused by malware.
-
Command and Scripting Interpreter: PowerShell
Using powershell.exe command.
-
Contacts third-party web service commonly abused for C2
Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.
-
Suspicious use of NtSetInformationThreadHideFromDebugger