Extracted

• • Target
    DOC/Tender bidding details.jse
  • Size 33KB
  • SHA256 8659501f8fd4c1522097a130af574aa302817d44b75f14777c9f30dcb2bc65ff
  • MD5 9ebc22becc3a8f2a37aca620dc71fd93
  • SHA1 b3296a7c2830ebaa3f87d1dce61d42fa39687620
  • SHA512 ac19db6e836bb018e13c73d30a206205e9bfc5d4fab5e15ddadf986de2cd409c1e136940cc7a18b7df1d6e9ab955c11dc7dd6e2cb5fe0e8aa32efde40205eb2c
  • SSDEEP 384:OWXgMkPJFv3PvvIs3NfabWsWpWQWR62xFoUCzQoQGvqKRcBjT0bXDq3ukBqJSGLz:CLhBnh/34DjKjv69IrJSGrMaCg
  • TLSH
    T103E2A5506A373930EEF766D8088F471A84DD19FF6C267817A9DFAB60E500DEC61E5C28
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  xlsx32collectiondefense_evasiondiscoverydownloaderexecutionguloaderremcosprivilege_escalationrat

  • Family: Guloader,Cloudeye

    A shellcode based downloader first seen in 2020.

    downloaderguloader

  • Family: Remcos

    Remcos is a closed-source remote control and surveillance software.

    ratremcos

  • Process spawned unexpected child process

    This typically indicates the parent process was compromised via an exploit or macro.

  • Badlisted process makes network request

    Network request originating from process or tool commonly abused by malware.

  • Accesses Microsoft Outlook profiles

    collection

  • Suspicious use of NtCreateThreadExHideFromDebugger

    defense_evasion

  • Suspicious use of NtSetInformationThreadHideFromDebugger

    defense_evasion
  behavioral1behavioral2