Extracted

• • Target
    SOA _ Juy - OCT 2026 Outstanding Bill _ BOOKING BIILLS.JS
  • Size 4.8MB
  • SHA256 d08f4fc508fb14f94e56ca055c858bf6efae6680110cb587c9f9c4a2a9ab8771
  • MD5 97da7c6062125c955254eb6d28f827d1
  • SHA1 34ee1cb4dfd90d7f7575104496936ff19317f752
  • SHA512 ba29e5393e8bdeba7e820e4efccf00b76a1d9fbfb85e417149a270ec4bbcb5ba9c62b2c2887eba1443aeed1d2f44b2bda6c931f7f30a92dfd430746bc0efacde
  • SSDEEP 98304:flrKYN1Px4kCQeua97PkswSPfrYWQm9P9iou45EIDKCj/JrCjfaginV6351Z/NpF:fNpNpxUD9wamYPy45EIhSfVinV637Z/d
  • TLSH
    T15F36E792238492F23721BFBC9639CD39D55AA00357C6CB30B05DD229761DD1BA7A87E3
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  remotehostcollectiondiscoveryexecutiondonutloaderremcosloaderpersistenceratspywarestealersuricata

  • Detects DonutLoader

    loader

  • Family: DonutLoader

    DonutLoader is a position-independent code that enables in-memory execution of VBScript, JScript, EXE, DLL files and dotNET assemblies.

    loaderdonutloader

  • Family: Remcos

    Remcos is a closed-source remote control and surveillance software.

    ratremcos

  • Suricata alert: REMCOS RAT Malware Inbound C2 Communication

    Network activity triggered a Suricata alert

    suricataremcos

  • Suricata alert: REMCOS RAT Malware Outbound C2 Communication

    Network activity triggered a Suricata alert

    suricataremcos

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Accesses Microsoft Outlook profiles

    collection

  • Adds Run key to start application

    persistence

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery

  • Executes a VBScript file via the Windows Script Host.

    execution
  behavioral1behavioral2