Extracted

• • Target
    請求書.JS
  • Size 6.9MB
  • SHA256 b87f7b38f087592979ec3a441c54dc45d31e8071736050c40aa31aa5d85a3275
  • MD5 1c56aca36f2350698d745e2a7f088873
  • SHA1 53a8c2384512efe911a3c151eb3d8603291d64e6
  • SHA512 e63cde54397caa17f7523ed63171035b8f45b335aa063edfe3d9684394afb1d6de2e01b1475b6ec80b6a688702867398b85b4039d6767d304970b7c0292dc9d2
  • SSDEEP 98304:EgbQz9aTVoKcJaKgCNobPn5hQxTU3gJhmLgJZTctqv32+anj9hx:zf5o28NobP5GxTUQGLgJxQhx
  • TLSH
    T1187641310354C631E3545FAB26A9B128640D5DCA98F9EB067A5EC7B0127E833E37B7B1
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  collectionexecutionagenttesladonutloaderkeyloggerloaderspywarestealertrojan

  • Detects DonutLoader

    loader

  • Family: AgentTesla

    Agent Tesla is a remote access tool (RAT) written in visual basic.

    keyloggertrojanstealerspywareagenttesla

  • Family: DonutLoader

    DonutLoader is a position-independent code that enables in-memory execution of VBScript, JScript, EXE, DLL files and dotNET assemblies.

    loaderdonutloader

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Reads user/profile data of local email clients

    Email clients store some user data on disk where infostealers will often target it.

    spywarestealer

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Accesses Microsoft Outlook profiles

    collection

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  behavioral1behavioral2