Extracted

• • Target
    CNV10230245.JS
  • Size 3.4MB
  • SHA256 e08536898810fdf8e197aacc91bd12c13be2d88fda08208df25481f7e4dd216b
  • MD5 c2a13f4f891f0d5367b34c307def505f
  • SHA1 9a46e797cc5a803ad3913501cbbd1367af2b1b29
  • SHA512 7043838f3fdf442237425d7a504ea8f7e51710f34ee10fb63b8a52168417d163bb5e567ed5aa5092f4f867eda936a1bb17287df34c4fd29cceaf0dfcf3c04007
  • SSDEEP 49152:oy67VfUuCAxHj2x9r/g1vqGGiHKJKCURIIwcNYkeYA6WVxiucjkzQwL1aYjLLwCj:LGGiHKJU2IwcNYk3A6WVwiF4YjLLwV+L
  • TLSH
    T129F5F508639965333716D39CE139EE38D80E9083A4D9CF58340ED6687A9DF07A758BE7
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  collectionexecutionagenttesladonutloaderkeyloggerloaderpersistencespywarestealertrojan

  • Detects DonutLoader

    loader

  • Family: AgentTesla

    Agent Tesla is a remote access tool (RAT) written in visual basic.

    keyloggertrojanstealerspywareagenttesla

  • Family: DonutLoader

    DonutLoader is a position-independent code that enables in-memory execution of VBScript, JScript, EXE, DLL files and dotNET assemblies.

    loaderdonutloader

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Reads user/profile data of local email clients

    Email clients store some user data on disk where infostealers will often target it.

    spywarestealer

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Accesses Microsoft Outlook profiles

    collection

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  behavioral1behavioral2