Extracted

• • Target
    Purchase order.JS
  • Size 3.0MB
  • SHA256 0a2bf7b6788a7255fd18fbdf34441bcf0944c88120f6e9c0999c4a595b5f46f6
  • MD5 8db8a3782d2eda71e1cba25d0210b8fa
  • SHA1 0c97e307ed2974650229ebb3b80d3b90b0826cf4
  • SHA512 957c6b605106fb91b0abff5c89c07d188c75b9a62fad40191b900c8b9cb1c0d52c6780acf2a4869bfd689629975880997a604683ae83d14c5eb52f78c151d839
  • SSDEEP 49152:kZamb5ikx5RqhkDAKY/ihBDE3Xlhg5kzGsEBsOMJUVOUxTAt5OE:kZamb5i85RqhkDAKY/ihBDE3XlC5kzGc
  • TLSH
    T1EFE506415764A0327669EBAC923ADE38544E600328D9DF1831BDD328796DD4BA39CFF3
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  collectionexecutionagenttesladonutloaderkeyloggerloaderspywarestealertrojan

  • Detects DonutLoader

    loader

  • Family: AgentTesla

    Agent Tesla is a remote access tool (RAT) written in visual basic.

    keyloggertrojanstealerspywareagenttesla

  • Family: DonutLoader

    DonutLoader is a position-independent code that enables in-memory execution of VBScript, JScript, EXE, DLL files and dotNET assemblies.

    loaderdonutloader

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Reads user/profile data of local email clients

    Email clients store some user data on disk where infostealers will often target it.

    spywarestealer

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Accesses Microsoft Outlook profiles

    collection

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  behavioral1behavioral2