Extracted

• • Target
    GEL - 6833.JS
  • Size 3.4MB
  • SHA256 6afff8ad5a1117810d288d1733be8b6148421e2224df826e82cb19318ba5ee5f
  • MD5 051cd5ae297cc6eed344fd8e36de05ef
  • SHA1 40e77d67437ffb1fa806bb09731695282ec3788f
  • SHA512 b9bbd501def87cf3a552969d075f26164b3e49438f80181a20709352ad79d5c3775910fa0405acf0e8b0d18b4c649614204f313b2db0f2a08e791f84ab9bbf3b
  • SSDEEP 98304:uP/VKIjyEOdu4+Lfc9c+pntd+d3WRdkdGdqVwKsaVmQk:W/LJOdu4+jWt8d4d5Lv
  • TLSH
    T10CF53A10A22827F1192DC73CD2365F9A24EDB08F616CFF1D355C0524EA96F276A8D9E3
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  collectionexecutionagenttesladonutloaderkeyloggerloaderpersistencespywarestealertrojan

  • Detects DonutLoader

    loader

  • Family: AgentTesla

    Agent Tesla is a remote access tool (RAT) written in visual basic.

    keyloggertrojanstealerspywareagenttesla

  • Family: DonutLoader

    DonutLoader is a position-independent code that enables in-memory execution of VBScript, JScript, EXE, DLL files and dotNET assemblies.

    loaderdonutloader

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Reads user/profile data of local email clients

    Email clients store some user data on disk where infostealers will often target it.

    spywarestealer

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Accesses Microsoft Outlook profiles

    collection

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  behavioral1behavioral2