Extracted

• • Target
    ShippingDocument.cmd
  • Size 6.5MB
  • SHA256 16346b77c4ad4a06553c32398694b6dc8ee835649e80eba4f8f204f43103ee04
  • MD5 49e9b566ff5c862e225f3e7d90131770
  • SHA1 bb0cbfd8327c5e03c4289b0764d9d5eb39f61f2b
  • SHA512 bb32897a9d00c5c8b7d64332aa243daf4537f82e6cf1d84c535cf95c44ef09adf65436ab944ed4e8d754d2fad72755bf34214aa92261e90b7691dbba76ef93a4
  • SSDEEP 49152:Z1jZLHrFQDBZRRDW1uiexpZOEy6n9ZyYvI9L9kjilFLEsqZNpi7rTdqRbNZYz:n
  • TLSH
    T1C6666B857D3734C4874D27CEE3269ECA268D4BCEFB04B55EB9F6568C331B09A8868471
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  remotehostcollectiondefense_evasiondiscoveryexecutiondonutloaderremcosloaderratspywarestealersuricata

  • Detects DonutLoader

    loader

  • Family: DonutLoader

    DonutLoader is a position-independent code that enables in-memory execution of VBScript, JScript, EXE, DLL files and dotNET assemblies.

    loaderdonutloader

  • Family: Remcos

    Remcos is a closed-source remote control and surveillance software.

    ratremcos

  • Suricata alert: REMCOS RAT Malware Inbound C2 Communication

    Network activity triggered a Suricata alert

    suricataremcos

  • Suricata alert: REMCOS RAT Malware Outbound C2 Communication

    Network activity triggered a Suricata alert

    suricataremcos

  • Command and Scripting Interpreter: PowerShell

    Run Powershell and hide display window.

    execution

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Accesses Microsoft Outlook profiles

    collection

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery

  • Deobfuscate/Decode Files or Information

    Payload decoded via CertUtil.

    defense_evasion
  behavioral1behavioral2