Extracted

• • Target
    AHK_32.js
  • Size 3.9MB
  • SHA256 7bcc28e8c5b0bfa9bcd311331c07d1e7bdeacc354b232f794c454fa083a2d64c
  • MD5 3366718e7b9e9282e33fb79598fd936a
  • SHA1 1c255106a7d3774752a2b79d0793e6a6735d7f81
  • SHA512 97bc007d56388078f59e77b20f51a1fa9ecf72bab82a7d5a67cb7782780ab8dcdd02ee91fb8cf2ea21b119a117d3c98dee791204c4b9ac36a498b26aea044e34
  • SSDEEP 98304:d19n48UJg/U4P2DWsmbcjIA9SJ6sOLAkguf3Q3u4ydn8arMl24EkJBJF8JQD/RZY:d1a8UJgfwJvQ48aww41F8yHfGAI3jXyk
  • TLSH
    T1D616E82FC660DE1E3BAD0ECD1DE7E1D86D8FFAD8C08CE9C3E1539190BB184959562264
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  bn432collectiondiscoveryexecutiondonutloaderremcosloaderratspywarestealersuricatapersistenceransomware

  • Detects DonutLoader

    loader

  • Family: DonutLoader

    DonutLoader is a position-independent code that enables in-memory execution of VBScript, JScript, EXE, DLL files and dotNET assemblies.

    loaderdonutloader

  • Family: Remcos

    Remcos is a closed-source remote control and surveillance software.

    ratremcos

  • Suricata alert: REMCOS RAT Malware Inbound C2 Communication

    Network activity triggered a Suricata alert

    suricataremcos

  • Suricata alert: REMCOS RAT Malware Outbound C2 Communication

    Network activity triggered a Suricata alert

    suricataremcos

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Accesses Microsoft Outlook profiles

    collection

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  behavioral1behavioral2