Extracted

• • Target
    Re-104772006900.pdf.lnk
  • Size 2KB
  • SHA256 e32c16f3ebd7b4472ec7ed4b4720c3f433441c30ec6086a40cb72dea1e1e593d
  • MD5 75c2991f5924c1864bebee5c21ee385e
  • SHA1 a9c2aa9b5188cd87a3081dd128e5114f8e96975e
  • SHA512 5c42f96f3bc4c9e218a839cb323bdac38439baa1b589d8c47edcff1c0213b14b06e065fd5aebc768ef65e04ad5b28dffdd26b5d895d590d949ab85a8e05507e6
  • TLSH
    T13641900037DA8615D5B75A360CA4E2108172BCC1E575CB2D315C98CD7B69308E838F3D
  • MD5 SHA1 SHA512 TLSH

  Score

  7^/10

  executionspywarestealer

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  behavioral1behavioral2
• • Target
    _
  • Size 9KB
  • SHA256 44911e09882c2a1dfb51436c6b9201fd435d0e2a479e55cfde50e51b351d3789
  • MD5 91d973064a21543eb61c088f96f49d52
  • SHA1 5d25691d3a4de93f3563f877bcdf8719e9c5a9c3
  • SHA512 46c7140fff3e12e8eb48bd0d2904d84f9514c81380e1f70690036f8f4d93208b3b1c846f78b01faf198fbd58068d283ab729da33a3b9459843ede7346245eec6
  • SSDEEP 192:mwihICqB2gugpK418UOyDwEKENmOgFSgByhmh7BfbdU7BFHXgdaht:mwieCqB2gugs418UnDw/OgFSgByhmh7i
  • TLSH
    T1FB1232F732048970CAEDF98BB76420E7A3E5C7674A4449C8716600BF982A77ED2D9394
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  adwarecollectiondefense_evasiondiscoveryexecutiondonutloaderoverlordvioletwormloaderpersistenceprivilege_escalationratspywarestealerworm

  • Detects DonutLoader

    loader

  • Detects Overlord RAT

  • Family: DonutLoader

    DonutLoader is a position-independent code that enables in-memory execution of VBScript, JScript, EXE, DLL files and dotNET assemblies.

    loaderdonutloader

  • Family: Overlord

    Overlord is an open-source Windows RAT written in Golang.

    ratoverlord

  • Family: VioletWorm

    VioletWorm is a Windows worm written in C#.

    wormvioletworm

  • Command and Scripting Interpreter: PowerShell

    Run Powershell and hide display window.

    execution

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Creates a file in the Startup directory

    A file was written to a Windows startup folder. Files in these directories are executed automatically when a user logs on or an application initializes.

    persistenceprivilege_escalation

  • Executes dropped EXE

  • Loads dropped DLL

  • Reads user/profile data of local email clients

    Email clients store some user data on disk where infostealers will often target it.

    spywarestealer

  • Accesses Microsoft Outlook profiles

    collection

  • Accesses cryptocurrency files/wallets, possible credential harvesting

    spyware

  • Discovers running processes

    Running process information can be used to identify security tools or plan follow-on actions.

    discovery
  behavioral3behavioral4