Extracted

• • Target
    _d1d0df395184892b0be7e7d6a8b2e310e2e80a424a95f9076abea84782d3fced.txt
  • Size 3.2MB
  • SHA256 d1d0df395184892b0be7e7d6a8b2e310e2e80a424a95f9076abea84782d3fced
  • MD5 7b4561477757da0c8df47044978f5c14
  • SHA1 04618431cf75b803c7d84058527ed618ce138ef8
  • SHA512 e222eb8a67581fcfaf015731154dc5efff5908939c93d3b5c4f1e240d309bc346d3e8c59ce7d6fb57552be62b58fcefc3de452275154d7aaf8cb9172a2791f43
  • SSDEEP 98304:1HkmFkfcUNGxaQfz3JMGa5H2VsWuYMJv5oEnr5F7K1bVzuBnUmkFjA:1LLez5ttv5oEr5F7AVzuBnYjA
  • TLSH
    T1F7F5E8109768A1776125E7AC953BDE78944F600318EACF1A349ED328B91CD4B97C8BF3
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  collectionexecutionagenttesladonutloaderkeyloggerloaderspywarestealertrojan

  • Detects DonutLoader

    loader

  • Family: AgentTesla

    Agent Tesla is a remote access tool (RAT) written in visual basic.

    keyloggertrojanstealerspywareagenttesla

  • Family: DonutLoader

    DonutLoader is a position-independent code that enables in-memory execution of VBScript, JScript, EXE, DLL files and dotNET assemblies.

    loaderdonutloader

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Reads user/profile data of local email clients

    Email clients store some user data on disk where infostealers will often target it.

    spywarestealer

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Accesses Microsoft Outlook profiles

    collection

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  behavioral1behavioral2