Extracted

• • Target
    Payment Advice07072026.JS.js
  • Size 3.0MB
  • SHA256 47d348a135dc108e273e3970976b65e2b481f47f34bcea495127f404d70c4c07
  • MD5 7420795cf6cbdbef068aa50d711c97b7
  • SHA1 436d21d2d92606e82f573ece5c29206df37315a7
  • SHA512 1f649d882692ff7fa7bf9b9843387ea2e39ec45a138b25de13aef41e0902bf139c7bc9d952eeb15a3942f5dfbddccc5fd90c27d3023f243a404cb18a240cd00f
  • SSDEEP 49152:yWocsIoyaQffNDFTRyP1D67MWQ+g/7bfmigWt0bxgaOjQi9jmw0qX0Ln7:yWochoyaQffNDFTEPo7i7bfmXZbxgaOY
  • TLSH
    T1D5E507515768E1737761E7AC913AEE74940E6003A8D9CF08306DE7287A2CD4BA758BF3
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  collectionexecutionagenttesladonutloaderkeyloggerloaderspywarestealertrojan

  • Detects DonutLoader

    loader

  • Family: AgentTesla

    Agent Tesla is a remote access tool (RAT) written in visual basic.

    keyloggertrojanstealerspywareagenttesla

  • Family: DonutLoader

    DonutLoader is a position-independent code that enables in-memory execution of VBScript, JScript, EXE, DLL files and dotNET assemblies.

    loaderdonutloader

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Reads user/profile data of local email clients

    Email clients store some user data on disk where infostealers will often target it.

    spywarestealer

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Accesses Microsoft Outlook profiles

    collection

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  behavioral1behavioral2