Extracted

• • Target
    Rechnung Nr. 2026-83.pdf.lnk
  • Size 1KB
  • SHA256 14bd1767f03831fbb954aa23b725f38919dcc2889b69c3dfe5484a8a4be3a8a8
  • MD5 1e001eae7ef2773e028399257a759361
  • SHA1 00e1bf08eaa60135493c153902acb7787ab88350
  • SHA512 413a479bd105685ae6262feb1bc45afa88f804acfdfdf6a920e90c863089c2665d94bbdb23d8b94146d18d6e12679df757d18a0c899e69a0701f2b6277bf9a9a
  • TLSH
    T1463144086EEB0324D3B28E7E68BAA2188567B901DE62CF6D008485CD35CF510F971F2B
  • MD5 SHA1 SHA512 TLSH

  Score

  10^/10

  executiondefaultdiscoveryasyncratdonutloaderloaderpersistenceprivilege_escalationrat

  • Async RAT payload

    rat

  • Detects DonutLoader

    loader

  • Family: AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Family: DonutLoader

    DonutLoader is a position-independent code that enables in-memory execution of VBScript, JScript, EXE, DLL files and dotNET assemblies.

    loaderdonutloader

  • Badlisted process makes network request

    Network request originating from process or tool commonly abused by malware.

  • Command and Scripting Interpreter: PowerShell

    Run Powershell and hide display window.

    execution

  • Command and Scripting Interpreter: PowerShell

    Run Powershell to get system information as a root user.

    execution

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Creates a file in the Startup directory

    A file was written to a Windows startup folder. Files in these directories are executed automatically when a user logs on or an application initializes.

    persistenceprivilege_escalation

  • Executes a VBScript file via the Windows Script Host.

    execution
  behavioral1behavioral2