Extracted

• • Target
    _b6b53447639ba3cabf6a16e27263c58ede0bef19706e2753bad2500d4f882678.txt
  • Size 4.3MB
  • SHA256 b6b53447639ba3cabf6a16e27263c58ede0bef19706e2753bad2500d4f882678
  • MD5 c1864ea3095bc18d3d4148244155e87a
  • SHA1 3c227c0c6fe1828cd541f9e06924afcefebce145
  • SHA512 59a9f5d585f14bb762de0eb0de22a15ed5b743bd967b9386aa1648fc28d765fe6fcba3e61b167840b47bbe15199f3355107655a74e9bad0c012b99f2c8251a75
  • SSDEEP 98304:eFvEu/UH6v5XJn7vqTkw+beMdgNFsA3hWzm3+tuZiX6ikYLpPuaTiFqaO7Xvy4dw:epEuManOkBBd0sAUmutkiX6ik8PiFemd
  • TLSH
    T142264B2052A9A772686D9FBCD5365F99063D200B1BB4DF0D337841A43A99F0B239D6F3
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  remotehostexecutiondonutloaderremcosloaderratsuricataadwarepersistencespyware

  • Detects DonutLoader

    loader

  • Family: DonutLoader

    DonutLoader is a position-independent code that enables in-memory execution of VBScript, JScript, EXE, DLL files and dotNET assemblies.

    loaderdonutloader

  • Family: Remcos

    Remcos is a closed-source remote control and surveillance software.

    ratremcos

  • Suricata alert: REMCOS RAT Malware Inbound C2 Communication

    Network activity triggered a Suricata alert

    suricataremcos

  • Suricata alert: REMCOS RAT Malware Outbound C2 Communication

    Network activity triggered a Suricata alert

    suricataremcos

  • Boot or Logon Autostart Execution: Active Setup

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

    persistence

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Enumerates connected drives

    Attempts to read the root path of hard drives other than the default C: drive.

  behavioral1behavioral2