Extracted

• • Target
    PO015462.JS
  • Size 5.6MB
  • SHA256 98a15caf5dd515d2d2f9a9404f33649b0999867fd5da2b097de35634668a49a9
  • MD5 fcab509a23a444c027a70be50eb2a161
  • SHA1 72ef39c6ef1e7ac354390dfc619c3a43eb194367
  • SHA512 691bebd0922f428ce8601db8e5dd44ddb68276b25412a3bbf6a59cac71b70efbf0f4405b94d6c9824ed8663e958ce9b9cfe08e0723e50fc6e5aa05907cdca529
  • SSDEEP 98304:o++3CgIV85DafvwBL+gUUd54fXR7Z2CCf3UZFw3seLFH9FjnPu:o++3SVSenWLyh1agwtLFH9pW
  • TLSH
    T1684683136B57903A630E475E99B2F5E5A81A2817B093DB07702CD824B3EBC5763AD1F3
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  collectionexecutionagenttesladonutloaderkeyloggerloaderspywarestealertrojan

  • Detects DonutLoader

    loader

  • Family: AgentTesla

    Agent Tesla is a remote access tool (RAT) written in visual basic.

    keyloggertrojanstealerspywareagenttesla

  • Family: DonutLoader

    DonutLoader is a position-independent code that enables in-memory execution of VBScript, JScript, EXE, DLL files and dotNET assemblies.

    loaderdonutloader

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Reads WinSCP keys stored on the system

    Tries to access WinSCP stored sessions.

    spywarestealer

  • Reads data files stored by FTP clients

    Tries to access configuration files associated with programs like FileZilla.

    spywarestealer

  • Reads user/profile data of local email clients

    Email clients store some user data on disk where infostealers will often target it.

    spywarestealer

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Accesses Microsoft Outlook profiles

    collection
  behavioral1behavioral2