Extracted

Extracted

• • Target
    SAMPLEREQUEST.JS
  • Size 2.7MB
  • SHA256 2dccf32718553092b52987f4b7b28f0ae43ff235e61998b8f9127be252d5008c
  • MD5 a9d4d2354aa664ae3bd050444d2f6a64
  • SHA1 8a09365a474b4c3992b75663199e0dd45acb23a2
  • SHA512 c18c1d33a4fa99d08a83b2d72a15cb83e8a0ad53541d5dc861fc07fa36d08ea942498ce9764a619bf73df675f0d7c856ee46a45e26c93928f9056936c06a8bdc
  • SSDEEP 49152:OFJERMTJBttig+rtkMSJv7V+nTXyr132Smp5DLNz/I1d3hKR/qg5mjDXQdyn3BeA:GCIJ4rxkMGvxk7PSmvLNz/I1d3hKR/qB
  • TLSH
    T13BD5F8559AB4A1237360E7AD513EDF78840F80032859CF453A8EDB29791DE87B3987E3
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  collectionexecutiondonutloadermassloggerloaderspywarestealer

  • Detects DonutLoader

    loader

  • Family: DonutLoader

    DonutLoader is a position-independent code that enables in-memory execution of VBScript, JScript, EXE, DLL files and dotNET assemblies.

    loaderdonutloader

  • Family: MassLogger

    Masslogger is a .NET stealer targeting passwords from browsers, email and cryptocurrency clients.

    stealerspywaremasslogger

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Reads user/profile data of local email clients

    Email clients store some user data on disk where infostealers will often target it.

    spywarestealer

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Accesses Microsoft Outlook profiles

    collection

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  behavioral1behavioral2