Extracted

• • Target
    PUCHASE ORDER-SFX-HO-26 9-27-215.JS
  • Size 3.4MB
  • SHA256 49e7803c15db5a2e2f8dde1236cd201b2e8592ebe29e1dc4b2f55c2a6bec482f
  • MD5 ab88b404bfcfc8dbf2f8317b5bc28de2
  • SHA1 ee4dc5336b83d235bfcdd53534e38d90fd039bbe
  • SHA512 bf277bd552cdad66b6126c009d5d383a3116a4ae5a6af8e297a7a1e91daf186484629d235e23d054496bc6e920e21c64598a0541bb47b8409ab21b8fdce6e02e
  • SSDEEP 98304:jf7iWDqStXOetszH9Vn99XAWRNoq2Uq/1PRwtdLePFb8Cw:jf7iWFXOeejQWRNVWEdLePFwCw
  • TLSH
    T1A9F50840D3347073226DD32CD6359EA869CEA00324D9CF2C72595B29B65BE47B349BEB
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  collectionexecutionagenttesladonutloaderkeyloggerloaderpersistencespywarestealertrojan

  • Detects DonutLoader

    loader

  • Family: AgentTesla

    Agent Tesla is a remote access tool (RAT) written in visual basic.

    keyloggertrojanstealerspywareagenttesla

  • Family: DonutLoader

    DonutLoader is a position-independent code that enables in-memory execution of VBScript, JScript, EXE, DLL files and dotNET assemblies.

    loaderdonutloader

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Reads user/profile data of local email clients

    Email clients store some user data on disk where infostealers will often target it.

    spywarestealer

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Accesses Microsoft Outlook profiles

    collection

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  behavioral1behavioral2