Extracted

• • Target
    invoice_2026 & packing list.JS
  • Size 5.6MB
  • SHA256 789843148af8202a575e81a00bb855e9c35f26fc8a1fb3b422bc75a257eac6bf
  • MD5 d18e57e802f8c3984588077736aa6a12
  • SHA1 b9bc21fbee2371a3db57c0d00defbb36162d0b21
  • SHA512 2324d5e72282b2286d93d64cddd46627cb131551eb5cbb7aa0d0bf57a6e3a37fd4c5b9dcd67cc46ea5d360ba6222f176c2422cdb82aeff862f0e9ed36439542a
  • SSDEEP 98304:Crfmol5lybTXdR15xxHob7UgPnC3Jw3KXQp97G8g:Cru+5s/1/xIM0UM9W
  • TLSH
    T1A146F803A957910BA74E475E99B2F6C9E81A2D2BF4136447B02CDC68E3DBD5372AD033
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  collectionexecutionagenttesladonutloaderkeyloggerloaderspywarestealertrojan

  • Detects DonutLoader

    loader

  • Family: AgentTesla

    Agent Tesla is a remote access tool (RAT) written in visual basic.

    keyloggertrojanstealerspywareagenttesla

  • Family: DonutLoader

    DonutLoader is a position-independent code that enables in-memory execution of VBScript, JScript, EXE, DLL files and dotNET assemblies.

    loaderdonutloader

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Reads user/profile data of local email clients

    Email clients store some user data on disk where infostealers will often target it.

    spywarestealer

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Accesses Microsoft Outlook profiles

    collection

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  behavioral1behavioral2