Extracted

• • Target
    Product_Specifications_RFQ.JS
  • Size 3.7MB
  • SHA256 05c633b990c6586efac89d4baf4a4b9958544cd5fdd22d412c7780be142283e6
  • MD5 7fc6ddd68cbad9e3613e9f9a7a3889bc
  • SHA1 17868de582a2e027024eea842841e2af078db876
  • SHA512 b846e001774e9a92f06f0b5b0fc446535758e8bc2a00c07fa290fb2a03dbfa101aa38fe7c5eb9f5be036451a7c427ab41ea51a012595819c9922c85eb8e27945
  • SSDEEP 98304:LYLCttgSJZ1+Nnn502Q1SvJKh8cueBgr9qeEnai01:LPqn5RQ1SvJI8cuTrKnE1
  • TLSH
    T1B006C5A08A5C99BCA5ACD70CD976F7460BDD52039068AF1E307D0954A7B6F0372CCEDA
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  collectionexecutionagenttesladonutloaderkeyloggerloaderspywarestealertrojan

  • Detects DonutLoader

    loader

  • Family: AgentTesla

    Agent Tesla is a remote access tool (RAT) written in visual basic.

    keyloggertrojanstealerspywareagenttesla

  • Family: DonutLoader

    DonutLoader is a position-independent code that enables in-memory execution of VBScript, JScript, EXE, DLL files and dotNET assemblies.

    loaderdonutloader

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Reads user/profile data of local email clients

    Email clients store some user data on disk where infostealers will often target it.

    spywarestealer

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Accesses Microsoft Outlook profiles

    collection

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  behavioral1behavioral2