Extracted

• • Target
    Informacion de impuesto de industria y comercio periodo 2025.msg
  • Size 76KB
  • SHA256 69ab7ab815add4bf63f5fa11803e18ed0138497bb38db8911372c8e443a53739
  • MD5 4ae0e876424f33bd207f964cc80b5c94
  • SHA1 3350a5714b36710b21ef92fc3114176465dd600b
  • SHA512 18d0123a578a944a896648f46a8ba045ee29d1aff4a869b127c975c2314f44d1d0b3564d6fd81dd8200df6599c164d6f95a6fe9301814754f2c2603c757ed65d
  • SSDEEP 1536:rO0wEkXcfvoARVzJ2VhLky2mLS44WKW+dF2jPOS88e6c/:rYEks3o0zQz2mWaGq
  • TLSH
    T1F47366152AF61215F2B3AF3549F5546789777C82AC34C94F3189330E0AB2E41ED62F6B
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  adwarecolombia10jjdefense_evasiondiscoveryexecutionasyncratdonutloaderloaderpersistenceransomwareratspyware

  • Async RAT payload

    rat

  • Detects DonutLoader

    loader

  • Family: AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Family: DonutLoader

    DonutLoader is a position-independent code that enables in-memory execution of VBScript, JScript, EXE, DLL files and dotNET assemblies.

    loaderdonutloader

  • Command and Scripting Interpreter: PowerShell

    Run Powershell and hide display window.

    execution

  • Executes dropped EXE

  • Adds Run key to start application

    persistence

  • Contacts third-party web service commonly abused for C2

    Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.

  behavioral1behavioral2