Extracted

• • Target
    75ebdaee1723f1157d81132bc667504e1353f9bba6863e4b804aa867dfcfa09c.js
  • Size 3.4MB
  • SHA256 75ebdaee1723f1157d81132bc667504e1353f9bba6863e4b804aa867dfcfa09c
  • MD5 cfa79d2e28273aeecdd8e57fd423af18
  • SHA1 3c7699cd8f83ff2b9daea1ab15c19bc445c1fb3c
  • SHA512 67fc2bc39c62fc2b4e0db5e88f2ed56f8b799038fd223d82d08398b83c7441161550b4489736174f4d93116af44ec5cf04ed611a0c30050c237c7d326ac5fc13
  • SSDEEP 98304:44cWO3eKPAQ5MrSh9f8Sh9QGwB00fE/n+iJ2YDu6aiWSKvWNA/Qwslsy9:ULbFQSrk0Jv/n+82Qu/WNL/lb
  • TLSH
    T11DF54B10E6642122919DDB3DC125FF68442D600B63B9EF0E37A895B4669AF07734EBF3
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  collectionexecutionagenttesladonutloaderkeyloggerloaderpersistencespywarestealertrojan

  • Detects DonutLoader

    loader

  • Family: AgentTesla

    Agent Tesla is a remote access tool (RAT) written in visual basic.

    keyloggertrojanstealerspywareagenttesla

  • Family: DonutLoader

    DonutLoader is a position-independent code that enables in-memory execution of VBScript, JScript, EXE, DLL files and dotNET assemblies.

    loaderdonutloader

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Reads user/profile data of local email clients

    Email clients store some user data on disk where infostealers will often target it.

    spywarestealer

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Accesses Microsoft Outlook profiles

    collection

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  behavioral1behavioral2