Extracted

• • Target
    BANK_PAYMENT_ADVICE09345.JS.js
  • Size 3.0MB
  • SHA256 2b6459d295e4969b852efc19a223a2b71f74d9725f7856fa77de74b8df1b27a5
  • MD5 73af9274eb29b24eefda6f0ad028d4d5
  • SHA1 81da216e41a70e01b20c11e484f17c708d2b254d
  • SHA512 002a717209b60b95f314b6113bd590d3dc05f4a63c18dd5db1b748ce6c69f99313e8b3e300f97e00dece79a3e11f7c1e6fbe82d8dbb18fb9df601e3d111aa9cd
  • SSDEEP 49152:sm8fbrdXdhW5/2APgtUVhZuYAenAWYjv38YEtPPblzjSnFRWRiGrLAhWNP56IlW/:sm8fbrddhW5/2APgtUVhZulenOjv35E4
  • TLSH
    T11DE52991675B9432A67DE71CD53AEA704A0E201325CADF1D306E93383A14E1B935FEE3
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  discoveryexecutionagenttesladonutloaderkeyloggerloaderspywarestealertrojan

  • Detects DonutLoader

    loader

  • Family: AgentTesla

    Agent Tesla is a remote access tool (RAT) written in visual basic.

    keyloggertrojanstealerspywareagenttesla

  • Family: DonutLoader

    DonutLoader is a position-independent code that enables in-memory execution of VBScript, JScript, EXE, DLL files and dotNET assemblies.

    loaderdonutloader

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Reads WinSCP keys stored on the system

    Tries to access WinSCP stored sessions.

    spywarestealer

  • Reads data files stored by FTP clients

    Tries to access configuration files associated with programs like FileZilla.

    spywarestealer

  • Reads user/profile data of local email clients

    Email clients store some user data on disk where infostealers will often target it.

    spywarestealer

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  behavioral1behavioral2