Extracted

• • Target

    msoffice_invoice1764727.doc

  • Size

    97KB

  • MD5

    5d38f68c18e3d9557523b25ad3fe4a86

  • SHA1

    a2c736b4bb06131dbb828c79711a1c7ec729d501

  • SHA256

    eef4b50a6a9a4371bc70b9b79d033053f0419c8c216118a6b5046117e4d6e272

  • SHA512

    4a6dcba8e2563f09dda60ac52dcda7f93e699f254a745d04ebbec57564e37371470e9d41473c2e33ad11256dea9f7a811810aeab1263a203048058c83a3f73f9

  Score

  10^/10

  taurus_stealerstealertrojan

  • Process spawned unexpected child process

    This typically indicates the parent process was compromised via an exploit or macro.

  • Taurus Stealer

    Taurus is an infostealer first seen in June 2020.

    trojanstealertaurus_stealer

  • Drops file in System32 directory

  • Suspicious use of SetThreadContext

  behavioral1behavioral2