Extracted

• • Target
    SAR23463566545.JS.js
  • Size 4.8MB
  • SHA256 ed803e8415b24a914fcef96c9c5551a089b1766b8f35c87ee2d182de5b10059e
  • MD5 0b1e3b63e08818f976fa321d52802fa2
  • SHA1 d4f864fb1d169d24c33718fcb6dd7369966b7614
  • SHA512 7c39bbc1d9fa8984854025d6b8b7a28ed7491d1c7ef10fe5795341f3350ee92d31fa81b5687e0888f5eb16acfacd8c8dd178b57253e694673a915579454e119f
  • SSDEEP 98304:qsPtnWaM8Btq2tlWkSQFQunlHZpFvEeGlIywHJ99BqAE/RgqZZzpGAYxjDTNdkxV:qaOilHL1UlBwHJnBqAE/Rgc3leRduiSb
  • TLSH
    T121361741130599F1662DBB3CE536DD7E9A4A300357CADF3E306992147B6AD0BA34CBE2
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  hostcollectiondiscoveryexecutiondonutloaderremcosloaderpersistenceratspywarestealersuricata

  • Detects DonutLoader

    loader

  • Family: DonutLoader

    DonutLoader is a position-independent code that enables in-memory execution of VBScript, JScript, EXE, DLL files and dotNET assemblies.

    loaderdonutloader

  • Family: Remcos

    Remcos is a closed-source remote control and surveillance software.

    ratremcos

  • Suricata alert: REMCOS RAT Malware Inbound C2 Communication

    Network activity triggered a Suricata alert

    suricataremcos

  • Suricata alert: REMCOS RAT Malware Outbound C2 Communication

    Network activity triggered a Suricata alert

    suricataremcos

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Accesses Microsoft Outlook profiles

    collection

  • Adds Run key to start application

    persistence

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery

  • Executes a VBScript file via the Windows Script Host.

    execution
  behavioral1behavioral2