Extracted

• • Target
    Purchase_Order_Quote_Confirmation_and_Validation.js
  • Size 1.2MB
  • SHA256 7cff45c050f2aea05a00eab59968fdc7e3a5562997405997a1d04c83186d4caa
  • MD5 d89f40d91cd56d153d1d1001ed6986e4
  • SHA1 08a682abe470a7c3eefdedbefa6da326d9c2ccb3
  • SHA512 4958c7cb4de188ded0983aee317c5d5ec0ab13e2b2db31009244bffe532de0113b6c82f8027ecd0bd42ec106ad83b36bf70a2ce6b7893c2d54a81916c4910abe
  • SSDEEP 24576:meSgYtlXdeZ7DF20SSSdBJm/DDE8edWa77fVgiay01nv:maDIFSWaE3X710Z
  • TLSH
    T1FF4533509CFDF8AF0730C3327B538F4E26111B54729A49972A561EC62B37E379A0796C
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  collectiondiscoveryexecutiondonutloadervipkeyloggerkeyloggerloaderpersistencestealeradwareransomwarespyware

  • Detects DonutLoader

    loader

  • Family: DonutLoader

    DonutLoader is a position-independent code that enables in-memory execution of VBScript, JScript, EXE, DLL files and dotNET assemblies.

    loaderdonutloader

  • Family: VIPKeylogger

    VIPKeylogger is a keylogger and infostealer written in C# and it resembles SnakeKeylogger that was found in 2020.

    stealerkeyloggervipkeylogger

  • Boot or Logon Autostart Execution: Active Setup

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

    persistence

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Accesses Microsoft Outlook profiles

    collection

  • Adds Run key to start application

    persistence

  • Enumerates connected drives

    Attempts to read the root path of hard drives other than the default C: drive.

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  behavioral1behavioral2