Extracted

• • Target
    Company Request.JS.js
  • Size 4.8MB
  • SHA256 2a791d8bb1c588f9fb8c411605afc8c4e939e9aa25663e92968299f175c27443
  • MD5 eacdfa4d09d8fe1848cb3edfee2f94cb
  • SHA1 621efee954573186c2d550e68ae6e5d320393baa
  • SHA512 3ee6db81c04baf280de7ad832ea04540ff94fd81f795916987318c585fa7ebd2ea56002b56e35208bfce3a187b9863eb05fe7eb13d9236efe71dd5ecdcf6def2
  • SSDEEP 98304:FSI/xzNVIxPe9/eyUciw+GC7VEGICKcVSo96A7CmEcX1tQoXf0uFRnAyC7lPcPDs:FSIZzNVIOziZGCsvPo90mdq82j7shjRk
  • TLSH
    T16D3606411FC7F972662DAB0CD23788B39A5A6C5315C6DF3D38688218F755E0BA34C9E2
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  testcollectiondiscoveryexecutiondonutloaderremcosloaderpersistenceratspywarestealersuricata

  • Detects DonutLoader

    loader

  • Family: DonutLoader

    DonutLoader is a position-independent code that enables in-memory execution of VBScript, JScript, EXE, DLL files and dotNET assemblies.

    loaderdonutloader

  • Family: Remcos

    Remcos is a closed-source remote control and surveillance software.

    ratremcos

  • Suricata alert: REMCOS RAT Malware Inbound C2 Communication

    Network activity triggered a Suricata alert

    suricataremcos

  • Suricata alert: REMCOS RAT Malware Outbound C2 Communication

    Network activity triggered a Suricata alert

    suricataremcos

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Accesses Microsoft Outlook profiles

    collection

  • Adds Run key to start application

    persistence

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery

  • Executes a VBScript file via the Windows Script Host.

    execution
  behavioral1behavioral2