Extracted

• • Target
    PO SKF LCS 19082026.pdf.cmd
  • Size 5KB
  • SHA256 9ff5bba37259f876eaa918db1940c74c3ed65f0ec98424cd7eae7e17aee4325a
  • MD5 56983ad11c775bdb21ce72092b999b86
  • SHA1 edbcdaaf455f520544616d25d1f0276ced210f8d
  • SHA512 2c4ca1479e088a0476b0689aa827d890482a521d2a5f67f9c4657271f29e2e4e616a30d23a7fa2c00145e38e28e2cdccee16b1d6210b78d84774a5576c285437
  • SSDEEP 96:e3kRLlsQAVNqHF5O78KlJtCCCiYsqcVDi9TIItKcY592hlP7tbyabQgAa:DRLlsQAVNqHHu8ktYiYsqqDi9EI4lOPT
  • TLSH
    T149B183F573C4E64455AA0B88057C8D8604B27BA40472FE4875FEDF8CACAA91D423CA99
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  remotehostdefense_evasiondiscoverydownloaderexecutionguloaderremcospersistencerat

  • Family: Guloader,Cloudeye

    A shellcode based downloader first seen in 2020.

    downloaderguloader

  • Family: Remcos

    Remcos is a closed-source remote control and surveillance software.

    ratremcos

  • Adds policy Run key to start application

    persistence

  • Badlisted process makes network request

    Network request originating from process or tool commonly abused by malware.

  • Executes dropped EXE

  • Adds Run key to start application

    persistence

  • Contacts third-party web service commonly abused for C2

    Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.

  • Obfuscated Files or Information: Command Obfuscation

    Adversaries may obfuscate content during command execution to impede detection.

    defense_evasion

  • Suspicious use of NtCreateThreadExHideFromDebugger

  • Suspicious use of NtSetInformationThreadHideFromDebugger

  behavioral1behavioral2