Extracted

• • Target
    Updated Proforma Invoice.cmd
  • Size 1.0MB
  • SHA256 d33287691b7a9dfb753be7b12fedcd18b58a75c1aaaff153e70d294c65bad1c8
  • MD5 6f02d40320d20a2ac6e7eaf4e26215a2
  • SHA1 3497aee8de46d6a96474c2374438af384eeb83f5
  • SHA512 ed13702d47d3aca209f0008ac14ab09e35f3b351f69f5cba6cc143fabd35a72f953a186b9c99388028b7ac91f164950dced267f16c81428cde2f17ab4081c9bf
  • SSDEEP 12288:vyJ0FmJg7COpYHvdAsAYsJXTPunzJLmOrFYeRVTR12Trb4ZBy2n70KkSfGNAHstt:vygmC71YPOsANJizpmeFYGVArf0G/ag
  • TLSH
    T14135234667E88173E9A42B70A8F741C70A35BD946FB4D3F72BA4698F0C725D09436B32
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  remotehostcollectioncredential_accessdefense_evasiondiscoveryexecutiondonutloaderremcosloaderpersistenceratspywarestealertrojan

  • Detects DonutLoader

    loader

  • Family: DonutLoader

    DonutLoader is a position-independent code that enables in-memory execution of VBScript, JScript, EXE, DLL files and dotNET assemblies.

    loaderdonutloader

  • Family: Remcos

    Remcos is a closed-source remote control and surveillance software.

    ratremcos

  • UAC bypass

    defense_evasiontrojan

  • Uses browser remote debugging

    Can be used to control the browser and steal sensitive information such as credentials and session cookies.

    credential_accessstealer

  • Executes dropped EXE

  • Loads dropped DLL

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Accesses Microsoft Outlook profiles

    collection

  • Adds Run key to start application

    persistence

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery

  • Suspicious use of SetThreadContext

  behavioral1behavioral2