Extracted

• • Target
    SOA MAY 2026.JS.js
  • Size 3.6MB
  • SHA256 22664b468509d5a3ef8d156c623b64fd1acf1ebb19d175af6990cfac6178b557
  • MD5 4bc6d7697b5fd603aa8525d9358db9b0
  • SHA1 3b419805a27d46fd695a56601260b894d2f9be75
  • SHA512 8d872bc428320fe356e73bb56e2e25e5871052d80db06798ba7d10581f68b97b6379c84997ef75b987321a681ffb86b729b556504a37d71c0560fa311725df2b
  • SSDEEP 98304:MvGY5O9LF6Heg0yJ/dHvQytb+3lhYPYvCFDXe45kF/0WXl/E3/K2qgbEBAaC/mTL:MJgsxHvQy5+3lhYPYvCFDXe45kF/0WXX
  • TLSH
    T17906E4915BB1A17677A0D7EE9137DF34A40E60031AE9CF44311FE228780DD8B6359AEB
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  collectionexecutionagenttesladonutloaderkeyloggerloaderspywarestealertrojan

  • Detects DonutLoader

    loader

  • Family: AgentTesla

    Agent Tesla is a remote access tool (RAT) written in visual basic.

    keyloggertrojanstealerspywareagenttesla

  • Family: DonutLoader

    DonutLoader is a position-independent code that enables in-memory execution of VBScript, JScript, EXE, DLL files and dotNET assemblies.

    loaderdonutloader

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Reads WinSCP keys stored on the system

    Tries to access WinSCP stored sessions.

    spywarestealer

  • Reads data files stored by FTP clients

    Tries to access configuration files associated with programs like FileZilla.

    spywarestealer

  • Reads user/profile data of local email clients

    Email clients store some user data on disk where infostealers will often target it.

    spywarestealer

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Accesses Microsoft Outlook profiles

    collection
  behavioral1behavioral2