Extracted

• • Target
    PO# ATVHCWS26-387 HANSUNG VINA..bat
  • Size 4KB
  • SHA256 93aec3da641e8a2d7191e5ec96e1678984c2441f129d6e91ad5741c896e1dfb0
  • MD5 31d385ec5f65aefdf08f7da9c3c800dd
  • SHA1 ad19bee37d50f8ae48dd9ea4a0ddffa901005135
  • SHA512 d54c97fa0facf2615223b69a110b73f12d66f08db9d9e78329083a87388e13fbfc6cc3649c09333cc31cc6311f41cbd8810097a5b0a28ae4ba1e9bb95751640e
  • SSDEEP 96:e0jGbpnoAQX55yRwRKpcTigi8rimi0C/VuU7DfmNzrzcv42XYDY3LYdni:ePNoAQX50Rw4CTigi8rimi0gVzn2nz0p
  • TLSH
    T1F381B649AAA91A756DC2298D9C0E538CCE13C0C0956F032C83DE766454692D7F1DEFEB
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  discoverydownloaderexecutionguloaderpersistenceprivilege_escalationvipkeyloggerkeyloggerstealer

  • Family: Guloader,Cloudeye

    A shellcode based downloader first seen in 2020.

    downloaderguloader

  • Family: VIPKeylogger

    VIPKeylogger is a keylogger and infostealer written in C# and it resembles SnakeKeylogger that was found in 2020.

    stealerkeyloggervipkeylogger

  • Badlisted process makes network request

    Network request originating from process or tool commonly abused by malware.

  • Use of msiexec (install) with remote resource

  • Command and Scripting Interpreter: PowerShell

    Using powershell.exe command.

    execution

  • Contacts third-party web service commonly abused for C2

    Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Suspicious use of NtCreateThreadExHideFromDebugger

  • Suspicious use of NtSetInformationThreadHideFromDebugger

  behavioral1behavioral2