Extracted

Extracted

• • Target
    QUOTATION REQUIREMENT - KAIZEN.cmd
  • Size 4.0MB
  • SHA256 bae9369203f95f6fb3b70e2f738b16aac651c2dcd82c47d87eb9f3a1336063dc
  • MD5 ba23f86252d4b990b12982a1a95e771e
  • SHA1 3101142c30b62891ab06bf6b8cf355a218f94eaa
  • SHA512 5fe6fc03d53b8a3b5742e751abc968a893c1beea1553bee7ba69a1b9185aad70099dc67d5f3cdfddbb7cc5a914f6b126da48c90dd664b18321ebf991740984e6
  • SSDEEP 24576:r222wJR8DE38ZsIzVbBtjfOdhqdUfsX7DzOr9tbDG5iciFEQxhl1xKv7xkNcF5pb:6jFD6PPPFBhBsghYm9yylJor
  • TLSH
    T17A167EC27E1F30E1C64857DEF7216F4D23888FC4B920BE9B97F93A9C651264E4D1A864
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  collectiondefense_evasiondiscoveryexecutiondonutloadermassloggerloaderpersistencespywarestealer

  • Detects DonutLoader

    loader

  • Family: DonutLoader

    DonutLoader is a position-independent code that enables in-memory execution of VBScript, JScript, EXE, DLL files and dotNET assemblies.

    loaderdonutloader

  • Family: MassLogger

    Masslogger is a .NET stealer targeting passwords from browsers, email and cryptocurrency clients.

    stealerspywaremasslogger

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Reads user/profile data of local email clients

    Email clients store some user data on disk where infostealers will often target it.

    spywarestealer

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Accesses Microsoft Outlook profiles

    collection

  • Deobfuscate/Decode Files or Information

    Payload decoded via CertUtil.

    defense_evasion

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  behavioral1behavioral2