Extracted

• • Target
    RFQ – Angebotsanfrage und Proforma-Rechnung für die beigefügten Produkte.JS.js
  • Size 5.6MB
  • SHA256 acb79df7ee7ccb16e1cc5cb55d0eaf42ab05c82311b43d5d141fd1a8613e1ff9
  • MD5 4c1c2d0599f03f5484ed68cdf4c7d456
  • SHA1 e3c227744dbe64290b2d9ecc62f60a87217b665a
  • SHA512 bdfc956ba14935ff4a7e1a9a2541971ec55e04412cabb4626848bb659b4282eedf766a92387bbc1be613dd740a64ea420c7bad4616f2590e0237ba7eab6dda2c
  • SSDEEP 98304:WwKX49+gXhd5rqWVDwViqEPJkEnAFHebJsDzr1HU2CPG0QhiXfmpecMMya7:N+g75rFDwgqqPa+bJsDzrObPlS+fMdM2
  • TLSH
    T12D46A7439755D132BB8397EEE7379840A81DA2F13D99CF39380EE6207618C5B62F91B1
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  collectiondiscoveryexecutionagenttesladonutloaderkeyloggerloaderspywarestealertrojan

  • Detects DonutLoader

    loader

  • Family: AgentTesla

    Agent Tesla is a remote access tool (RAT) written in visual basic.

    keyloggertrojanstealerspywareagenttesla

  • Family: DonutLoader

    DonutLoader is a position-independent code that enables in-memory execution of VBScript, JScript, EXE, DLL files and dotNET assemblies.

    loaderdonutloader

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Reads user/profile data of local email clients

    Email clients store some user data on disk where infostealers will often target it.

    spywarestealer

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Accesses Microsoft Outlook profiles

    collection

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  behavioral1behavioral2