Extracted

• • Target
    Factura Y Albarans.JS
  • Size 5.6MB
  • SHA256 fcced086a0c2d1ebfbb1a6355d36d6365ceab9dee0dc9c30144e8572279ef896
  • MD5 e13b3fda36626c792813b37fbb23970b
  • SHA1 82eab33dc500b4aa8da6fb8e7dbde4f247c162a7
  • SHA512 df41f69cd3e1b19425bb87cd0a6703150b9fd7f168cec341bc893637f25790f7148f15d98d4b324f7464ea89a19ee6f4baabe5a04cb5bfbb87c6fa1222d058b1
  • SSDEEP 98304:pTDpEjvAd65/52e8v3vVjWvIc23BB9zPNAioeF4/fp8xhJ70KolJqt4xZ:zYC4Uec3l62xvP1qM4KeJvxZ
  • TLSH
    T1C04694136B57903AA70E475D95B2F5E5A81A2C17B092DB0B702CD824B3EBC5363AD1F3
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  collectionexecutionagenttesladonutloaderkeyloggerloaderspywarestealertrojan

  • Detects DonutLoader

    loader

  • Family: AgentTesla

    Agent Tesla is a remote access tool (RAT) written in visual basic.

    keyloggertrojanstealerspywareagenttesla

  • Family: DonutLoader

    DonutLoader is a position-independent code that enables in-memory execution of VBScript, JScript, EXE, DLL files and dotNET assemblies.

    loaderdonutloader

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Reads user/profile data of local email clients

    Email clients store some user data on disk where infostealers will often target it.

    spywarestealer

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Accesses Microsoft Outlook profiles

    collection

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  behavioral1behavioral2