General
- Target August20Due20invoives20payment20advice20250826YHUJ.js
- Size 5.4MB
- Sample260827-ltwheaseqh
- SHA256 c35b38ddab1c5d4da4a94baaf3b845e4d35f01f9522f1df8d7e8bbd8990ee8c2
Score
10/10
Malware Config
Targets
-
- Target August20Due20invoives20payment20advice20250826YHUJ.js
- Size 5.4MB
- SHA256 c35b38ddab1c5d4da4a94baaf3b845e4d35f01f9522f1df8d7e8bbd8990ee8c2
Score10/10-
Detects DonutLoader
-
Family: DonutLoader
DonutLoader is a position-independent code that enables in-memory execution of VBScript, JScript, EXE, DLL files and dotNET assemblies.
-
Family: Remcos
Remcos is a closed-source remote control and surveillance software.
-
Suricata alert: REMCOS RAT Malware Inbound C2 Communication
Network activity triggered a Suricata alert
-
Suricata alert: REMCOS RAT Malware Outbound C2 Communication
Network activity triggered a Suricata alert
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Executes dropped EXE