Extracted

• • Target
    PO2789543.JS
  • Size 4.5MB
  • SHA256 d3f1a59bea524704c1075e1821932ae3af1d5bc1fab47983394b0371fc8f15f5
  • MD5 442f529762e79310b2f93730c86a63c7
  • SHA1 79bb49dea5babc8ade7c1414db912ce50ddc61b6
  • SHA512 e8811ee979b6d54b58cc712115df21275e416cb1f2b629459679ce19d62b99dfd05450ac708a4fc94d27fa9c7a34a59861dfba5905985f6b4a28cda75602985b
  • SSDEEP 98304:QNEwoNzy3ZMotMEU+BJuFSlKRI8ltWcZVhdkzzNHKv7GDkBSs6KToOcgKBYMOTwl:+EfP+QFRI81JIzNqiDIvT9kOEC76Z4/6
  • TLSH
    T1A6265A40717862CB2A38CB69D81D2FDB3D4E65F3E938CD89729E483B958CF096920757
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  remotehostcollectiondefense_evasiondiscoveryexecutiondonutloaderremcosloaderpersistenceratspywarestealersuricatatrojan

  • Detects DonutLoader

    loader

  • Family: DonutLoader

    DonutLoader is a position-independent code that enables in-memory execution of VBScript, JScript, EXE, DLL files and dotNET assemblies.

    loaderdonutloader

  • Family: Remcos

    Remcos is a closed-source remote control and surveillance software.

    ratremcos

  • Suricata alert: REMCOS RAT Malware Inbound C2 Communication

    Network activity triggered a Suricata alert

    suricataremcos

  • Suricata alert: REMCOS RAT Malware Outbound C2 Communication

    Network activity triggered a Suricata alert

    suricataremcos

  • UAC bypass

    defense_evasiontrojan

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Accesses Microsoft Outlook profiles

    collection

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  behavioral1behavioral2