Extracted

• • Target
    _d3d8e0363520cf5dd010122ffdf1ffe4d73f461029caa992d381dae096f16db2.exe
  • Size 282KB
  • SHA256 d3d8e0363520cf5dd010122ffdf1ffe4d73f461029caa992d381dae096f16db2
  • MD5 37732f094ee78c5a820f225aa70f44b1
  • SHA1 0bf7c92460da65ec5040d4c84171fc55dca0bd06
  • SHA512 d61ccc307a21117f4f5c77cc9eecf00ffed32aba843fccec29be41a9bec21cb2899299bbffcc2e8cca425d42088bc6de49c3a8f9888d659dc8593a971a82a0c2
  • SSDEEP 3072:F+qgkOGD10ynJ+IleSiC8iiX3cJKA0fVvgmBEi/b3MsWz0zdtn+5JK+4oR1A2RDF:g4JlYBEITMsWYR8KP63ebdmOy4jr
  • TLSH
    T19F547E55F7A508FAEE77853CC9924606EA727C524760DACB03A04EA71F237E09E3E711
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defense_evasiondiscoverydonutloaderremus_stealerloaderspywarestealerpersistence

  • Detects DonutLoader

    loader

  • Family: DonutLoader

    DonutLoader is a position-independent code that enables in-memory execution of VBScript, JScript, EXE, DLL files and dotNET assemblies.

    loaderdonutloader

  • Family: Remus

    Remus is a stealer written in C++.

    stealerremus_stealer

  • Reads user/profile data of local email clients

    Email clients store some user data on disk where infostealers will often target it.

    spywarestealer

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Accesses cryptocurrency files/wallets, possible credential harvesting

    spyware

  • Adds Run key to start application

    persistence

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery

  • Indicator Removal: File Deletion

    Adversaries may delete files left behind by the actions of their intrusion activity.

    defense_evasion

  • Enumerates processes with tasklist

    discovery
  behavioral1behavioral2