General
- Target 31072026_0330_RFQ NTU SG855�pdf.bat.zip
- Size 1KB
- Sample260731-d2fsxstand
- SHA256 900279cab8e9b823fa0d77273521bf554fefd7f7a10b749564f68a0cd12ca633
Score
8/10
Malware Config
Targets
-
- Target RFQ NTU SG855·pdf.bat
- Size 3KB
- SHA256 c0187621b5f791c0706054050e7c45f0afe0706714c6f6942888d1025729bfe8
Score8/10-
Badlisted process makes network request
Network request originating from process or tool commonly abused by malware.
-
Contacts third-party web service commonly abused for C2
Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.
-
Network Service Discovery
Attempt to gather information on host's network.
-
Suspicious use of NtCreateThreadExHideFromDebugger
-
Suspicious use of NtSetInformationThreadHideFromDebugger