Extracted

• • Target
    INVOICE AND PL.JS
  • Size 3.1MB
  • SHA256 87d9f4fc7f470e4723c6171d4a9fb3f37998663b84ab46965d2d7d4729fc444e
  • MD5 f44ea37db819ee43e33195acbf1b225f
  • SHA1 1c100ba62fa3524681332fc71af8d9ac26f082bf
  • SHA512 c2e0c569219fa387dbfdc80f5626da678115e6be2279af4b88d83ee35ede4c112158f7de6c724aca126f4fc34d13d5b9ddd6932266f359a9ff306e1df62113e7
  • SSDEEP 98304:OF2OF+IleVRP+bg/aQWpfUS9lWs0yx7I7f49fyhzrRjT/3LOPpROlcKoKpZE7e9X:gFZYl/aXcS9lWs0yx78f49fyhzrRjT/B
  • TLSH
    T144E5195296E4511B7361EBDD522DDE78B80E84532819CF90B58EE73C382DE8AE2147F3
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  collectionexecutionagenttesladonutloaderkeyloggerloaderpersistencespywarestealertrojan

  • Detects DonutLoader

    loader

  • Family: AgentTesla

    Agent Tesla is a remote access tool (RAT) written in visual basic.

    keyloggertrojanstealerspywareagenttesla

  • Family: DonutLoader

    DonutLoader is a position-independent code that enables in-memory execution of VBScript, JScript, EXE, DLL files and dotNET assemblies.

    loaderdonutloader

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Reads user/profile data of local email clients

    Email clients store some user data on disk where infostealers will often target it.

    spywarestealer

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Accesses Microsoft Outlook profiles

    collection

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  behavioral1behavioral2