Extracted

• • Target
    Scan 00029475437890.JS.js
  • Size 4.7MB
  • SHA256 480c0ae3fcd1d7240dba3000c9650b987f46110ec0be9a4c7883438246a3ffb3
  • MD5 ab7e95c40da644c68b51287705ffb839
  • SHA1 f2e5aefd6c9c9f946150111671a2d6ae0a18a2f3
  • SHA512 12d76fa3dba1abdb71f0cd8c0d0ff976766d7d7eeaf4cff7925467b2970575b59ce907d8ed95639ad359ca77d30215d41eda9bbdf79253a88242f76e28f48b07
  • SSDEEP 98304:OGrMQTyQFQceFVeClGTFHdPo9sWefw79knjef7mTXtNO3LdTGZdyGr/AnoXo8amA:OGs7VeQGRHdPo9sWeo586SvJnyiAnq6R
  • TLSH
    T19D36384123449172B62DAB5CF636D97B9A4A204315CADF3D32BCB3187758D0BA35CBE2
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  remotehostcollectiondiscoveryexecutiondonutloaderremcosloaderpersistenceratspywarestealerdefense_evasiontrojan

  • Detects DonutLoader

    loader

  • Family: DonutLoader

    DonutLoader is a position-independent code that enables in-memory execution of VBScript, JScript, EXE, DLL files and dotNET assemblies.

    loaderdonutloader

  • Family: Remcos

    Remcos is a closed-source remote control and surveillance software.

    ratremcos

  • UAC bypass

    defense_evasiontrojan

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Accesses Microsoft Outlook profiles

    collection

  • Adds Run key to start application

    persistence

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery

  • Executes a VBScript file via the Windows Script Host.

    execution
  behavioral1behavioral2