Extracted

• • Target
    images_95858005050050.JPG.hta
  • Size 14KB
  • SHA256 e7de6197ad8312d8722b477d3ca988e196f17be5f5498eedc4b8d3c6c3791993
  • MD5 316d50da6b463f299393cfd8697fed8b
  • SHA1 9521d8845e0423014d098c75cc8ca0007cdaf6f8
  • SHA512 6e668c49e7e22635c7919f1995efad173fe502f1045fcc3987c746db0148f2f8b6eb9708104b389d469646a96f5cc3bf26648a93402ed807fb0f4621d8eec5e0
  • SSDEEP 48:3GXn1MU8GfXy61MU8G/XzuuuSHRuuzFsBuuuuoXJZXYkLrND1MU8GMKXSG:2Xa/IXK/EXlXzXo/8X9
  • TLSH
    T1F8624FBD6B58F9D1CBAB61FC2758751325BC407369B00B26B8ED0523732027D9A2D28F
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  nano3collectiondiscoveryexecutiondonutloaderremcosloaderratspywarestealer

  • Detects DonutLoader

    loader

  • Family: DonutLoader

    DonutLoader is a position-independent code that enables in-memory execution of VBScript, JScript, EXE, DLL files and dotNET assemblies.

    loaderdonutloader

  • Family: Remcos

    Remcos is a closed-source remote control and surveillance software.

    ratremcos

  • Badlisted process makes network request

    Network request originating from process or tool commonly abused by malware.

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Accesses Microsoft Outlook profiles

    collection

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery

  • Enumerates connected drives

    Attempts to read the root path of hard drives other than the default C: drive.

  behavioral1behavioral2