Extracted

Extracted

• • Target
    RFQ-NGT-E-26-7441-NJ.bat
  • Size 144KB
  • SHA256 79582e012802adcffa4d96ba0ae9a7138f771aeeb76f858ed5af09ff94e45f94
  • MD5 cade65133bfecdf1d6da5638141a4306
  • SHA1 915d89adc1b5420cdd061e4af063357713a64524
  • SHA512 b832e35dda2cdac419d20c94c54379002876ff371aeedc299bb545b6969b8f33d3a2a52ceb4d553787056259442fe93a1d883b2209bd91cb3ec973eb9715dfa7
  • SSDEEP 3072:hng4NsqNnjQrqsJqsVo3uo9tfVTSd/Am5CX:hhMrUsHovBSd/te
  • TLSH
    T147E3F022D5C82F78CE781E28E17E042E73E1C69B9266754AE353FD463F9B508922F1C5
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  collectiondefense_evasionexecutiondonutloadermassloggerloaderpersistenceprivilege_escalationspywarestealer

  • Detects DonutLoader

    loader

  • Family: DonutLoader

    DonutLoader is a position-independent code that enables in-memory execution of VBScript, JScript, EXE, DLL files and dotNET assemblies.

    loaderdonutloader

  • Family: MassLogger

    Masslogger is a .NET stealer targeting passwords from browsers, email and cryptocurrency clients.

    stealerspywaremasslogger

  • Event Triggered Execution: Component Object Model Hijacking

    Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.

    persistenceprivilege_escalation

  • Accesses Microsoft Outlook profiles

    collection

  • Adds Run key to start application

    persistence

  • Command and Scripting Interpreter: PowerShell

    Using powershell.exe command.

    execution

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  behavioral1behavioral2