Extracted

Extracted

• • Target
    Request for Quotation-BD00900M.bat
  • Size 122KB
  • SHA256 248812accf82ca745dd93e7f825be990dec0dfdce44ec3e1d8475f523962fa5c
  • MD5 44f12568e269e12959a4ac4d91dcef87
  • SHA1 7b87eeb6faa8e90a919333e1c494a1ac7912a513
  • SHA512 1ee270e7d1eb56ec48c95f91da21a12435a2e3cadc8978e2b33bea3ea540ce4c53ac537e78e97e308a5f30d59997b66ab60e19f54d54f9d6b79dcca020a83a49
  • SSDEEP 1536:QYJd+UtGpRzxyld/VwQNdr2jcVRMXeOeotTngXTqSbVMy9SFbYZZ9TsTe:QYL7Up4/VwQNcjKqtTnCLVMy9SFu7Ge
  • TLSH
    T1EFC3E1138DD96F74DEB8473500F83A62FBB0868A6151778AB7436C99AFFA504034E1DB
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  collectiondefense_evasionexecutiondonutloadermassloggerloaderpersistenceprivilege_escalationspywarestealer

  • Detects DonutLoader

    loader

  • Family: DonutLoader

    DonutLoader is a position-independent code that enables in-memory execution of VBScript, JScript, EXE, DLL files and dotNET assemblies.

    loaderdonutloader

  • Family: MassLogger

    Masslogger is a .NET stealer targeting passwords from browsers, email and cryptocurrency clients.

    stealerspywaremasslogger

  • Command and Scripting Interpreter: PowerShell

    Run Powershell and hide display window.

    execution

  • Event Triggered Execution: Component Object Model Hijacking

    Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.

    persistenceprivilege_escalation

  • Accesses Microsoft Outlook profiles

    collection

  • Adds Run key to start application

    persistence

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  behavioral1behavioral2