Extracted

• • Target
    Payment Copy.JS
  • Size 3.4MB
  • SHA256 ba9aacda332ab5e1a943b3287ae0de2abcb6801731142dc7b3c32a2733eaf5c7
  • MD5 448060752f0fb1574c3f3abcc344a533
  • SHA1 e7ac4b9588282d16751973f1646e0b5ee5c6f58f
  • SHA512 d0531363ad78f10eb9777ae676d234bc3709135b0dfed4057ec20490424eef71a55e1f72cf6b974679eca7db5b054150e5c8e002714b1328e27236a3cda16fc5
  • SSDEEP 98304:m6YMnFffxxLYXjoYt4/M7C6y6JGtB3HWDmXmwm3QIUE:m6YMnFffPktf5+pm3Qs
  • TLSH
    T118F5F8ACD128730A645DA76EC6196FD9023E500F3738AE0CB77918745A6FF1B249F1A3
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  collectionexecutionagenttesladonutloaderkeyloggerloaderpersistencespywarestealertrojan

  • Detects DonutLoader

    loader

  • Family: AgentTesla

    Agent Tesla is a remote access tool (RAT) written in visual basic.

    keyloggertrojanstealerspywareagenttesla

  • Family: DonutLoader

    DonutLoader is a position-independent code that enables in-memory execution of VBScript, JScript, EXE, DLL files and dotNET assemblies.

    loaderdonutloader

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Reads user/profile data of local email clients

    Email clients store some user data on disk where infostealers will often target it.

    spywarestealer

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Accesses Microsoft Outlook profiles

    collection

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  behavioral1behavioral2