Extracted

• • Target
    MT103.JS.js
  • Size 3.1MB
  • SHA256 2c6011645daa6ea192a6a23ef564753e20b4f65e7b90b7e202ff84a835fcdc27
  • MD5 fd960fcde32eb18f1b2e0a3adcf999f2
  • SHA1 9b3bcee35529ab8dbff186c748c29df2f0455de8
  • SHA512 c9363f3c2a5e72ac31bc1800753a354f56e9b01811ad6d843fc08f56ce8810e392c2faef64517cab2abf21ac14eee64b8109fe019151154bdad76866ce512180
  • SSDEEP 98304:sQmBnsiupkZ3h/1/P174AMoQLb302UgFAdF8e2n+Ft33x5yU3vF0yunBE644uNJH:GBns3pkZh/1/P174AMoQLb302UgFAdFT
  • TLSH
    T14EE5295295E862233320FBED962DDE38940EE4432D198F54798EEB387D2CF89E214757
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  collectionexecutionagenttesladonutloaderkeyloggerloaderpersistencespywarestealertrojan

  • Detects DonutLoader

    loader

  • Family: AgentTesla

    Agent Tesla is a remote access tool (RAT) written in visual basic.

    keyloggertrojanstealerspywareagenttesla

  • Family: DonutLoader

    DonutLoader is a position-independent code that enables in-memory execution of VBScript, JScript, EXE, DLL files and dotNET assemblies.

    loaderdonutloader

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Reads user/profile data of local email clients

    Email clients store some user data on disk where infostealers will often target it.

    spywarestealer

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Accesses Microsoft Outlook profiles

    collection

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  behavioral1behavioral2