Extracted

• • Target
    New Company Request_7e77e.JS.js
  • Size 4.8MB
  • SHA256 13cdb327d6e653416650c1abfa768b46908df46d146a1ab73476339fc055a9eb
  • MD5 b650c452e0488e70fa26a6bbf72d5f0d
  • SHA1 caf4718d57f8cec0901ba3e4521234117c4bb0ff
  • SHA512 55a7ba36c054afbfaf2475debd3db5c3f98afd24df8f87dd8ea344016f7fd8284e068496c47641d9d7af1a463f274b12abef68bbe0918ef9a27c36a19c669b40
  • SSDEEP 98304:R3ui2aFV11ky0xeefml5US0M3p+apAPPTkF5+iGGHa0czQjg2im/Nhh5jjIQOmUs:R+i2aFV11kGew/Z+aC3TkF5va0cUjgDu
  • TLSH
    T1FC36F58A2336D57265299B0CD3F78971990A2C3335C7CF3D32689A197719D0FA35CAE2
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  remotehostcollectiondiscoveryexecutiondonutloaderremcosloaderpersistenceratspywarestealersuricata

  • Detects DonutLoader

    loader

  • Family: DonutLoader

    DonutLoader is a position-independent code that enables in-memory execution of VBScript, JScript, EXE, DLL files and dotNET assemblies.

    loaderdonutloader

  • Family: Remcos

    Remcos is a closed-source remote control and surveillance software.

    ratremcos

  • Suricata alert: REMCOS RAT Malware Inbound C2 Communication

    Network activity triggered a Suricata alert

    suricataremcos

  • Suricata alert: REMCOS RAT Malware Outbound C2 Communication

    Network activity triggered a Suricata alert

    suricataremcos

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Accesses Microsoft Outlook profiles

    collection

  • Adds Run key to start application

    persistence

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery

  • Executes a VBScript file via the Windows Script Host.

    execution
  behavioral1behavioral2