Extracted

• • Target
    ZAMÓWIENIE ZAKUPU 190626.110238.JS
  • Size 3.6MB
  • SHA256 90b91648203307db3fbb3cfae69046d83892caf4c49fa8bf48e41e652b4a4e3f
  • MD5 55b97fe8523fd1d6992d6a4d8b3f3a26
  • SHA1 491015f02a9b0536fe176840e34787bb3717474c
  • SHA512 2072379ca1d00bc95e88cd86e96f89f65cefb62fba4607dc6c4b8e51f37ab2f6b854cf49a20ca907832bd83cdd87d192864beaaba73a685056456f8117c1c485
  • SSDEEP 98304:Wn3lxhCIw/EhYHmJIqxnK2Pwr72T26FwyPlmFcL:ShJwuYHmJIqxnK2PU72T2kwyPsFcL
  • TLSH
    T15606F6915BA0E13B3761DBAE513BDF74A40E640328EACF10311EE618794DD8B635CAE7
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  collectionexecutionagenttesladonutloaderkeyloggerloaderspywarestealertrojan

  • Detects DonutLoader

    loader

  • Family: AgentTesla

    Agent Tesla is a remote access tool (RAT) written in visual basic.

    keyloggertrojanstealerspywareagenttesla

  • Family: DonutLoader

    DonutLoader is a position-independent code that enables in-memory execution of VBScript, JScript, EXE, DLL files and dotNET assemblies.

    loaderdonutloader

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Reads user/profile data of local email clients

    Email clients store some user data on disk where infostealers will often target it.

    spywarestealer

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Accesses Microsoft Outlook profiles

    collection

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  behavioral1behavioral2