Extracted

Extracted

• • Target
    23062026_1647_RequestForQuotationMichelin25540-GG419AD.bat
  • Size 3KB
  • SHA256 dbba28480670c15a4649b2251ff7f137d8d1be2180caa38d0f2e7e9ea0a105de
  • MD5 c0cd91650f99d938972dc7dd521f1885
  • SHA1 a16c4a7b676a738283070fa841d7de8c1f5a38cc
  • SHA512 ebc0baa5c828791531cd12ac38840ce9cf47a8cec15aee607e4009a463ab166875e736f2f04ad1e9417f47b20c9bc2dc32c30873e1eacf1d10abb90e872990ef
  • TLSH
    T1DA716455F3414BA8EA1F0419C89339E66CEF274C0621895CDE78475B4D33BCCD27AD6A
  • MD5 SHA1 SHA512 TLSH

  Score

  10^/10

  lucollectiondiscoverydownloaderexecutionguloaderremcospersistencerat

  • Family: Guloader,Cloudeye

    A shellcode based downloader first seen in 2020.

    downloaderguloader

  • Family: Remcos

    Remcos is a closed-source remote control and surveillance software.

    ratremcos

  • Detected Nirsoft tools

    Free utilities often used by attackers which can steal passwords, product keys, etc.

  • Badlisted process makes network request

    Network request originating from process or tool commonly abused by malware.

  • Accesses Microsoft Outlook accounts

    collection

  • Accesses Microsoft Outlook profiles

    collection

  • Adds Run key to start application

    persistence

  • Suspicious use of NtCreateThreadExHideFromDebugger

  • Suspicious use of NtSetInformationThreadHideFromDebugger

  • Suspicious use of SetThreadContext

  behavioral1behavioral2