Extracted

• • Target
    Cargo_Loading_Photos_CONT-MSKU123456.JS
  • Size 2.5MB
  • SHA256 1aa11a88ef3b708d33f70ae93ccc95acab88939193bc28c6856a3f1405a3ae89
  • MD5 2d6bfe13adac7d1beafba71f55bdc460
  • SHA1 edb17cd856187b8b9fa45ddd78c76b4d5902a887
  • SHA512 96443d8b0532ad8cb9debd9c5c480f954e2debfe9ac3cbbcdea8f72af0ec81145248841900912423504c649f62546b5989cd757b86627305cbf09276e4019879
  • SSDEEP 49152:kdd88+PFi3qg9ltPWjQLRrMPGzhQBQNH0MLToC6VbI4wsLMljcxO7DUChVqpNAW:kddt+PFi3qg9ltPWjQLRYPGzhQB40MLq
  • TLSH
    T1C8C50851ABE491737360E7AD423EDE74940E4003289ACF54749EE7283C1DE4BA768BE7
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  executiondonutloadermassloggerloaderspywarestealercollection

  • Detects DonutLoader

    loader

  • Family: DonutLoader

    DonutLoader is a position-independent code that enables in-memory execution of VBScript, JScript, EXE, DLL files and dotNET assemblies.

    loaderdonutloader

  • Family: MassLogger

    Masslogger is a .NET stealer targeting passwords from browsers, email and cryptocurrency clients.

    stealerspywaremasslogger

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Reads user/profile data of local email clients

    Email clients store some user data on disk where infostealers will often target it.

    spywarestealer

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Accesses Microsoft Outlook profiles

    collection

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  behavioral1behavioral2