Extracted

• • Target
    ECF_26_646.JS
  • Size 3.1MB
  • SHA256 58a54ec5f73f0c32963ff751050dc2ccb3148a27d8b9c7f1bfe1bf03d1cda13d
  • MD5 a4b5f79672daea3431f95be13cf8aa2d
  • SHA1 03cbedc6cd37620e24a668fe92131a7633a2d01f
  • SHA512 3a595452f180987b3e0d6899770433cce9284d77081714bacdf799f0bf00f5cc1bd66f12a473742d42dbe3dd9f42b4a32c1fffc384c151e4773c39da556b2ff8
  • SSDEEP 98304:jcpD30Lgluf44Okx63b3CM8v8ryGOMDlm8K/Ae8Y:Yp0T63CM8vsOKpVel
  • TLSH
    T1F7E508115764A233B3A0D79D523ADF38940E900369E9CF1A345ED6287A1CD4BE39CBE7
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  collectionexecutionagenttesladonutloaderkeyloggerloaderpersistencespywarestealertrojan

  • Detects DonutLoader

    loader

  • Family: AgentTesla

    Agent Tesla is a remote access tool (RAT) written in visual basic.

    keyloggertrojanstealerspywareagenttesla

  • Family: DonutLoader

    DonutLoader is a position-independent code that enables in-memory execution of VBScript, JScript, EXE, DLL files and dotNET assemblies.

    loaderdonutloader

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Reads user/profile data of local email clients

    Email clients store some user data on disk where infostealers will often target it.

    spywarestealer

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Accesses Microsoft Outlook profiles

    collection

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  behavioral1behavioral2