Extracted

• • Target
    Purchase Order Enclosed – Request for Proforma Invoice_pdf.JS
  • Size 3.3MB
  • SHA256 60be20de5a7fed689ea71986d861b3d4c29ef84f703957a1921e4c7fb8c7af74
  • MD5 96d5fecdf200d9c7d6fcc8c76be356f7
  • SHA1 ff3fb07d4ce74781d975104641feec86ecba841e
  • SHA512 9cb7e1653a56a7e43dd013ca74c959b32c4b56f551722c528e25f380957cbcdae49725d17b14ce80cfcf10ad882f0d2b09c42c7c27ce252ed00ad46d09062329
  • SSDEEP 98304:zbEpWQ8rMQzPwYVqpvQ+2I2ENsFbdxa639/z:zb/nMUXyQ2Qbza639/z
  • TLSH
    T18DF519416796E13373A1DB5C4236DD30A80E640318CACF55316ED3393B6CE5BA39AAE7
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  executionagenttesladonutloaderkeyloggerloaderspywarestealertrojan

  • Detects DonutLoader

    loader

  • Family: AgentTesla

    Agent Tesla is a remote access tool (RAT) written in visual basic.

    keyloggertrojanstealerspywareagenttesla

  • Family: DonutLoader

    DonutLoader is a position-independent code that enables in-memory execution of VBScript, JScript, EXE, DLL files and dotNET assemblies.

    loaderdonutloader

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Reads user/profile data of local email clients

    Email clients store some user data on disk where infostealers will often target it.

    spywarestealer

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  behavioral1behavioral2