Extracted

• • Target
    _67aa3033ac68dadc36096277895080e9de3191d75541a884d761f4d38bd4a770.txt
  • Size 4.5MB
  • SHA256 67aa3033ac68dadc36096277895080e9de3191d75541a884d761f4d38bd4a770
  • MD5 e9d69275e98cd99b663a37f57d2f7532
  • SHA1 7e054718cb1088063eff8f3b196c80461e5a976f
  • SHA512 5b56f8e7b5850126220d0ae9548241c9e93eebcccebee1a874aeb0a814b6a88d8595e5cf07150cb3b55076e2dab6a40349d1b8ce64afd4cf4833ca79be8935d1
  • SSDEEP 98304:SVEg3mr5LrIXRl8k/xwu5BL5EuOMuognRRQsQtjL4IGTG3tbw9TAocMPkPcRxiVC:S2AL5w4BIR2sD+tc+ocTpOkAg3wqMbgs
  • TLSH
    T13A264B1153289276516DE76CD2379F6806BDE0135BEACF0C32AD47247A49F0B9B4CAE3
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  duntokexecutiondonutloaderremcosloaderratsuricataadwarepersistenceransomwarespyware

  • Detects DonutLoader

    loader

  • Family: DonutLoader

    DonutLoader is a position-independent code that enables in-memory execution of VBScript, JScript, EXE, DLL files and dotNET assemblies.

    loaderdonutloader

  • Family: Remcos

    Remcos is a closed-source remote control and surveillance software.

    ratremcos

  • Suricata alert: REMCOS RAT Malware Inbound C2 Communication

    Network activity triggered a Suricata alert

    suricataremcos

  • Suricata alert: REMCOS RAT Malware Outbound C2 Communication

    Network activity triggered a Suricata alert

    suricataremcos

  • Boot or Logon Autostart Execution: Active Setup

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

    persistence

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Enumerates connected drives

    Attempts to read the root path of hard drives other than the default C: drive.

  behavioral1behavioral2