Extracted

• • Target
    Purchase order.JS
  • Size 3.4MB
  • SHA256 246a486dc86e5af0be162ea41d5cf5d61dbbdc1310200ecc830f9ea5cfa39eb8
  • MD5 e478d8b18dcb8bc32c5dc460983764c8
  • SHA1 49b5cd0f09456341a16ea83d864dd54f75809efa
  • SHA512 8853a62404ec835594fcd13945fb0298c9923c7c52e228bb7556a97e29d610449c5168b4d0e99505ac0db12b06db42bb12c7e684b70c7dac05c6a68d42e23c83
  • SSDEEP 98304:W7vpdK7qR4m+/T6qrESc3712k0jyiFnU9b/BkmO+v7A:W7vO7TlkMRniu+v7A
  • TLSH
    T108F509509334A5B2611DCF2ED035BF58480D25436888DF6E36B81B24BA9AE17739CEF7
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  collectionexecutionagenttesladonutloaderkeyloggerloaderpersistencespywarestealertrojan

  • Detects DonutLoader

    loader

  • Family: AgentTesla

    Agent Tesla is a remote access tool (RAT) written in visual basic.

    keyloggertrojanstealerspywareagenttesla

  • Family: DonutLoader

    DonutLoader is a position-independent code that enables in-memory execution of VBScript, JScript, EXE, DLL files and dotNET assemblies.

    loaderdonutloader

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Reads user/profile data of local email clients

    Email clients store some user data on disk where infostealers will often target it.

    spywarestealer

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Accesses Microsoft Outlook profiles

    collection

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  behavioral1behavioral2