Extracted

• • Target
    BB465menu.bat
  • Size 2.1MB
  • SHA256 ccf3b6c2b9e9fa9759c27bab084bf4386484f07a88c72ec0fec6155d44fe4d34
  • MD5 50164f6e1c9c63d9982e25b29db5ff82
  • SHA1 1d033c5acde9b2c2b1902dc8944dae70bfac624a
  • SHA512 569d5ce8c0555233288b9ee3adb56a3ea2da0b05ccc85fae7003cb3212cc4d4dac7a72de8c3733a4250c022bc3dbae2f698c90e62ba699ffb4cd3b64258e3413
  • SSDEEP 24576:ospW0qb4fev8/XH1AUsYuyGz5cuekb8ootaKbf:ospHqbBvIqouN1ekbNKT
  • TLSH
    T10DA5C0C257F7917EEA7E10FEA19022858A6E10047CF193D42861F2EEBCD3D469DC6D86
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defense_evasiondiscoveryexecutiondonutloaderneptuneratloaderpersistencetrojan

  • Detects DonutLoader

    loader

  • Detects NeptuneRAT stealer

  • Family: DonutLoader

    DonutLoader is a position-independent code that enables in-memory execution of VBScript, JScript, EXE, DLL files and dotNET assemblies.

    loaderdonutloader

  • Family: NeptuneRAT, MasonRAT

    NeptuneRAT aka MasonRAT is a trojan written in C#.

    trojanneptunerat

  • Badlisted process makes network request

    Network request originating from process or tool commonly abused by malware.

  • Command and Scripting Interpreter: PowerShell

    Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

    execution

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Contacts third-party web service commonly abused for C2

    Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.

  behavioral1