Extracted

• • Target
    ajrbqhit.JS
  • Size 3.0MB
  • SHA256 f5e077f77888a995668685a41b0e79828eee17ff5e09a41266364b28693dd92f
  • MD5 53255e916a48115f5a668552f9c07b4e
  • SHA1 c77f6cdcbd71a72c14238c0820ef76b5016cee27
  • SHA512 92aadda3c440bd91f2fa89c7c48feda8a0245a40537d81c2e41dd6a373cbb5d3b10af08476299e78b08435b9c0f86f279c8d8d857775a7b5b719e52a7e54cd26
  • SSDEEP 49152:TObjNC/pc8FqbW4cwqVcg+n4sAe46V0+9BK7mVlfgrA5ocLxJkfc1Z:TObjNC/pc8FqbWNwqVcg+n4sAe46V0+T
  • TLSH
    T15EE5184567A492737320EBAD963EDE74940E504368D9CF44309ED7383A2CE4BA758BE3
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  collectionexecutionagenttesladonutloaderkeyloggerloaderspywarestealertrojan

  • Detects DonutLoader

    loader

  • Family: AgentTesla

    Agent Tesla is a remote access tool (RAT) written in visual basic.

    keyloggertrojanstealerspywareagenttesla

  • Family: DonutLoader

    DonutLoader is a position-independent code that enables in-memory execution of VBScript, JScript, EXE, DLL files and dotNET assemblies.

    loaderdonutloader

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Reads user/profile data of local email clients

    Email clients store some user data on disk where infostealers will often target it.

    spywarestealer

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Accesses Microsoft Outlook profiles

    collection

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  behavioral1behavioral2