Extracted

• • Target
    SDA0976545678000.bat
  • Size 491KB
  • SHA256 be9d95459d188c6669e202e3e195dab7f8f69854cabe9edb63524aad6813bf24
  • MD5 d9f59fb3d3ebd3516f76d35e64087542
  • SHA1 767e7d090f9a8a4989e39d74fa5f60f7e0efee9f
  • SHA512 d06352882ff0b065982e3752d4f6a43c7fdda210e98fd20fa26a687408bfc72b6ce1d9e80c3c1a844ef420ab86f3714d3c14b9375138e4136026041e83e3b01a
  • SSDEEP 6144:xA7J+w57RQWnfz1D66fGyRBtkyZl/0bbBfw4ja7KpktkeTmpmdFLW36Dvjpbcol5:xAfRQ4z12YbOyZlcZCu5qLNbbSgnI34
  • TLSH
    T149B4F1129ACC2F68CEB85B2894FC161E73A0868B401375CADB737D56AFEB941530F1D9
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defense_evasionexecutionagenttesladonutloaderkeyloggerloaderpersistenceprivilege_escalationspywarestealertrojan

  • Detects DonutLoader

    loader

  • Family: AgentTesla

    Agent Tesla is a remote access tool (RAT) written in visual basic.

    keyloggertrojanstealerspywareagenttesla

  • Family: DonutLoader

    DonutLoader is a position-independent code that enables in-memory execution of VBScript, JScript, EXE, DLL files and dotNET assemblies.

    loaderdonutloader

  • Command and Scripting Interpreter: PowerShell

    Run Powershell and hide display window.

    execution

  • Event Triggered Execution: Component Object Model Hijacking

    Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.

    persistenceprivilege_escalation

  • Adds Run key to start application

    persistence

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  behavioral1behavioral2