Extracted

• • Target
    PO 1583_2026 Ajdin dat. 25092026 -$23,750.bat
  • Size 1KB
  • SHA256 4ec17f6aca363913fe6df78bcf7a2176cd52bfa29647e0af1473ab00863374d6
  • MD5 0f8d263474eca9b32ba2c1bf52ee8311
  • SHA1 c83c681ffde5a20d6d4fc902af68fca867daa854
  • SHA512 4fd0e30a4c68743f6850bfd6c7650c82c4091789fb1a3308d4233b85e3cf17ac914c874a7025461641d5164f5427cb1aa19a9adb5127384c3c0ec8ccea76fe6c
  • TLSH
    T1304186759E36F8E40B7DB290E4B93D8720951A57C7710B98EA111EB47C0A341DF3638C
  • MD5 SHA1 SHA512 TLSH

  Score

  10^/10

  backdoordefense_evasiondiscoveryexecutionpersistenceprivilege_escalationratrevoked_codesign

  • Badlisted process makes network request

    Network request originating from process or tool commonly abused by malware.

  • Command and Scripting Interpreter: PowerShell

    Run Powershell and hide display window.

    execution

  • Sets service image path in registry

    This determines the executable launched when a service starts. It can be used to establish persistence.

    persistence

  • Signed with revoked ConnectWise certificate

    Binary is signed using a ConnectWise certificate revoked for key compromise.

    revoked_codesign

  • ConnectWise ScreenConnect remote access tool

    ConnectWise ScreenConnect is a remote desktop tool that can be used as a backdoor.

    backdoorrat

  • Event Triggered Execution: Component Object Model Hijacking

    Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.

    persistenceprivilege_escalation

  • Executes dropped EXE

  • Loads dropped DLL

  • Enumerates connected drives

    Attempts to read the root path of hard drives other than the default C: drive.

  • Boot or Logon Autostart Execution: Authentication Package

    Suspicious Windows Authentication Registry Modification.

    persistenceprivilege_escalation

  • Drops file in System32 directory

  behavioral1behavioral2
• • Target
    actualizados 967838131-967838132.pdf
  • Size 415KB
  • SHA256 62fd08b7757e2b8fffcbedfb94f3b8cf3f7c34850128b66f84f8fcaa93c8452f
  • MD5 1a5f2614481b80ab297e93cb519cc277
  • SHA1 24f01714c54f064dd8fe902e0bd9632b7d321a32
  • SHA512 9cb9d05bc8853d4ec4cd953ae6d699c9e72185633217db5c582aaf227bf385d3d0e1b6a133a1b431ef14061d06bdd53a127e152162b9a0191d66c084a83bddc6
  • SSDEEP 12288:7+dGobxTsQlp9lyjJIPJn/9m7ipjefXGjV49PzoN:KdN9TsCp98jSPO7ip29PcN
  • TLSH
    T19494231B109214DECD58583326356E8764E7767326AE3F3B860DF245A989FBB42B720C
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  3^/10

  adwarediscoveryspyware
  behavioral3behavioral4