Extracted

Extracted

• • Target
    Enquiry QUOTATION REF NO AH0409231.bat
  • Size 1.1MB
  • SHA256 6c403ed3119dae79cc5abf671489c6b1053ae5de11d249c74b3a9e9c01d86634
  • MD5 61a5049fb91d6a8b1659c267dd2d8713
  • SHA1 17d136a21801102060dabe962c0c7f472ab5d194
  • SHA512 1f2cdc381b34923027da25ac313e8a5da22b50f6faf7e0bd390e62c8f3830905e76d37bc01ccdf77e51c080c328b4dc744f6dc4812f437c23b05fcd068d87e88
  • SSDEEP 24576:O1c/O+dKc0lIhuMbA1JvGZGhan0GSSFfx/B51Bo:O2xQcAI0bLaJlvo
  • TLSH
    T12835F215D6C87F78CFA85A3980FD1A1E73E09A4B9016B94AE7237C4AAFEF544020F1D5
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  collectiondefense_evasiondiscoveryexecutiondonutloaderphantom_stealerloaderpersistenceprivilege_escalationstealer

  • Detects DonutLoader

    loader

  • Detects PhantomStealer written in C#

  • Family: DonutLoader

    DonutLoader is a position-independent code that enables in-memory execution of VBScript, JScript, EXE, DLL files and dotNET assemblies.

    loaderdonutloader

  • Family: PhantomStealer

    Phantom Stealer is a stealer written in C#, forked from the Stealerium family.

    stealerphantom_stealer

  • Command and Scripting Interpreter: PowerShell

    Run Powershell and hide display window.

    execution

  • Event Triggered Execution: Component Object Model Hijacking

    Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.

    persistenceprivilege_escalation

  • Accesses Microsoft Outlook profiles

    collection

  • Adds Run key to start application

    persistence

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  behavioral1behavioral2