Extracted

• • Target
    Scanned025211122026.js
  • Size 3.9MB
  • SHA256 e04b1f395133f522f7c9316a06dea43cdd8c65975a31b4789b93cbe7b64c52b6
  • MD5 85b09ed67e77da508b6ce6e73746d389
  • SHA1 19ed0e32246b8b8f5072ee7543c8bc034e24247d
  • SHA512 4836d2260fe0929d12f39f87ba70902f258ea40add1530e1e8ba7a833a3ae196b492e675feecf832ec0c01d9ab6203588b0e76eca946dc8ef41c6664140d7e78
  • SSDEEP 98304:1ldXg8kBY3MYf2LOcuzcrwQtiZaEeT484uXXg3Ogi9XE6DMFuIM0ZhBtsRor/RRA:1l68kBYfIpHgoE6I4IFtsS3H2ooXDNJn
  • TLSH
    T15D16C63FCFE24F2933D51BCC5DA581D8F59DA708C0486ADB715BA598DB14FBA1AC2220
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  remotehostcollectiondiscoveryexecutiondonutloaderremcosloaderpersistenceratspywarestealersuricataransomware

  • Detects DonutLoader

    loader

  • Family: DonutLoader

    DonutLoader is a position-independent code that enables in-memory execution of VBScript, JScript, EXE, DLL files and dotNET assemblies.

    loaderdonutloader

  • Family: Remcos

    Remcos is a closed-source remote control and surveillance software.

    ratremcos

  • Suricata alert: REMCOS RAT Malware Inbound C2 Communication

    Network activity triggered a Suricata alert

    suricataremcos

  • Suricata alert: REMCOS RAT Malware Outbound C2 Communication

    Network activity triggered a Suricata alert

    suricataremcos

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Registers new Windows logon scripts automatically executed at logon.

    persistence

  • Accesses Microsoft Outlook profiles

    collection

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  behavioral1behavioral2