Extracted

Extracted

• • Target
    GRAADS.A. eINFO3634763575473644652467735.cmd
  • Size 6KB
  • SHA256 286ae740278234a35e85eb0c2931824f4df807b0840de2675c66e3ca2d892a17
  • MD5 0950bdf90e621959b5550f3fe45a9c66
  • SHA1 6ed07c52478f00e170a16de91326945c3f2acf11
  • SHA512 dfb7fd34423c3af848f855a6d927ccf57b8affe970ee692287b51b7001aa5ad30d213b031efb525df3117099b0e12526ff032bdf6e07f9cf79a37dd0748cc6e4
  • SSDEEP 192:/bFmaJwxkpvGZQQWJeFF9fkmsORi6vEJc/gnPvTCBHVWPE:jFm1aGYmnf5O6v5/gnnTC3N
  • TLSH
    T1B6D1D6101748634AE14B2FF2C4DFC687E6BD026CC5086840E2BACA49BD72D5C5BB89CE
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  buxtonfinacollectiondefense_evasiondiscoverydownloaderexecutionguloaderremcospersistenceprivilege_escalationratsuricata

  • Family: Guloader,Cloudeye

    A shellcode based downloader first seen in 2020.

    downloaderguloader

  • Family: Remcos

    Remcos is a closed-source remote control and surveillance software.

    ratremcos

  • Suricata alert: REMCOS RAT Malware Inbound C2 Communication

    Network activity triggered a Suricata alert

    suricataremcos

  • Suricata alert: REMCOS RAT Malware Outbound C2 Communication

    Network activity triggered a Suricata alert

    suricataremcos

  • Detected Nirsoft tools

    Free utilities often used by attackers which can steal passwords, product keys, etc.

  • Badlisted process makes network request

    Network request originating from process or tool commonly abused by malware.

  • Command and Scripting Interpreter: PowerShell

    Run Powershell and hide display window.

    execution

  • Accesses Microsoft Outlook accounts

    collection

  • Accesses Microsoft Outlook profiles

    collection

  • Adds Run key to start application

    persistence

  • Suspicious use of NtCreateThreadExHideFromDebugger

    defense_evasion

  • Suspicious use of NtSetInformationThreadHideFromDebugger

    defense_evasion

  • Suspicious use of SetThreadContext

  behavioral1behavioral2