Extracted

• • Target
    Fiyat Teklifi.js
  • Size 3.9MB
  • SHA256 696a2a46b97a6bb4d5aa5995f69dc6fc31af74a2c091bc623b563f6f748bf466
  • MD5 a3c8788eb338b933a6e2d1a6672b2de8
  • SHA1 1305c35297b884f9749b6bb173f96a1126fa298f
  • SHA512 8d3f7c835489f1fc779e59a7c28e50a545704bc0f7936e4cddcce9300b46f5af04a93e524d21d9c20b40d1052bf208044a17f0355499bdc18382de33f594a4e3
  • SSDEEP 98304:HQsAjuu5nDHtC2dYDv9cC9aXCqQeM0Z5mymo/h8p+gOjRCU/IrAL5WU5m0eh6T5I:HQbuu5nJVtp/njRFAru5m5oDt7vzS5vZ
  • TLSH
    T10D16E91EDB208E59389F0DCCECD2D3DA8DDDEE36C4474DCBA15193BBD7648914A62228
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  bsatcollectiondiscoveryexecutiondonutloaderremcosloaderpersistenceratspywarestealersuricataransomware

  • Detects DonutLoader

    loader

  • Family: DonutLoader

    DonutLoader is a position-independent code that enables in-memory execution of VBScript, JScript, EXE, DLL files and dotNET assemblies.

    loaderdonutloader

  • Family: Remcos

    Remcos is a closed-source remote control and surveillance software.

    ratremcos

  • Suricata alert: REMCOS RAT Malware Inbound C2 Communication

    Network activity triggered a Suricata alert

    suricataremcos

  • Suricata alert: REMCOS RAT Malware Outbound C2 Communication

    Network activity triggered a Suricata alert

    suricataremcos

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Registers new Windows logon scripts automatically executed at logon.

    persistence

  • Accesses Microsoft Outlook profiles

    collection

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  behavioral1behavioral2