Extracted

• • Target
    加薪文件.pdf.JS.js
  • Size 4.7MB
  • SHA256 3a8b76c8a88ef370afd431332536ca05029fed6fe71f74b3f60ddf02d233cbed
  • MD5 9ff5301e004756663ed4e7862ee38dec
  • SHA1 75a3c0795c6bcf5a342564ba832153bdfd65e1ec
  • SHA512 938fa323bc15d53354731f522b82056d5a8a62405d5181f93c9f8f34ebef8cf60551c402baa67feb2f94d1729813229b66bf5fa8dd2dce548ee0de0d8e78323c
  • SSDEEP 98304:KcpsROyP2D7lI49b4LEkJBo13edACWUkXvP6T5RUW68vMC6gLhJBw0dEYhjZcDTD:FSofu49b4LToRedpRkXviT5mWEUBwcNM
  • TLSH
    T186365A48A09477C5D87C3E71AD1DEFDE073E228B9B25E83B332814E92B5DB963194319
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  remotehostcollectioncredential_accessdefense_evasiondiscoveryexecutiondonutloaderremcosloaderpersistenceratspywarestealertrojan

  • Detects DonutLoader

    loader

  • Family: DonutLoader

    DonutLoader is a position-independent code that enables in-memory execution of VBScript, JScript, EXE, DLL files and dotNET assemblies.

    loaderdonutloader

  • Family: Remcos

    Remcos is a closed-source remote control and surveillance software.

    ratremcos

  • UAC bypass

    defense_evasiontrojan

  • Uses browser remote debugging

    Can be used to control the browser and steal sensitive information such as credentials and session cookies.

    credential_accessstealer

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Accesses Microsoft Outlook profiles

    collection

  • Adds Run key to start application

    persistence

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery

  • Executes a VBScript file via the Windows Script Host.

    execution

  • Suspicious use of SetThreadContext

  behavioral1behavioral2