Extracted

Extracted

• • Target
    PO Euro Trading 1117-P24010.pdf.cmd
  • Size 5KB
  • SHA256 e60db63214d90e9561f077baf23cdfd1514e4a390fe5595d517e6c26f81ce45d
  • MD5 0ec5a3a49010dd5305d1dfa1b20f2e76
  • SHA1 d7aba6b124cf0a12654f2753a95f7281e4a71530
  • SHA512 1246f1a54ad9373bd867711b0cf2e53652f1d4927e021f714c483143ff73fa850266d24928331c63f1c242ac5a78648357f8d48014858b831be5dd77103dc3c5
  • SSDEEP 96:eXQ/ZYRk0S1VNMAevjkazMOlFaCCz7GOyhIDYOAl2dGeFTPF2JfPz:dCk0S1VNrOz9sz7GfIxAleGeF5aPz
  • TLSH
    T1D1B1B9B86398D388898B0AA5C869CCA314B1673559827D08B1FBDA0C9D57D6C437DFF8
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  remotehostdefense_evasiondiscoverydownloaderexecutionguloaderremcospersistencerat

  • Family: Guloader,Cloudeye

    A shellcode based downloader first seen in 2020.

    downloaderguloader

  • Family: Remcos

    Remcos is a closed-source remote control and surveillance software.

    ratremcos

  • Adds policy Run key to start application

    persistence

  • Badlisted process makes network request

    Network request originating from process or tool commonly abused by malware.

  • Executes dropped EXE

  • Adds Run key to start application

    persistence

  • Command and Scripting Interpreter: PowerShell

    Using powershell.exe command.

    execution

  • Contacts third-party web service commonly abused for C2

    Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.

  • Obfuscated Files or Information: Command Obfuscation

    Adversaries may obfuscate content during command execution to impede detection.

    defense_evasion

  • Suspicious use of NtCreateThreadExHideFromDebugger

  • Suspicious use of NtSetInformationThreadHideFromDebugger

  behavioral1behavioral2