Extracted

• • Target
    INV0987653456789000.JS
  • Size 3.8MB
  • SHA256 bc9f2718cdf3f4e38769c43af9b7376bf9143ce707c3d1236ddb11c8c2ad6be0
  • MD5 9dc83256f1f573db41265b5b255ab187
  • SHA1 08da22beb4cd06fd74dbc6e15ddd60d76dcd37e5
  • SHA512 76753c711287d7531d405648d76538ce2311f71f3d8e3d133e671c22a66dc3c36ad9c9ebfec66e507f69c9c90a13fd08de243c627c792451bb95a558b3ed33f3
  • SSDEEP 98304:FHe2o03npjzPa1DmuvHPfSXtzKq4x7RUtPWEucJZc5mWv8Jo7pWuz:F0opfaVm2yX54FaPsmJZuz
  • TLSH
    T1990608CCC864CACEDAE4F7048D9BEEA1035D71179C25EE47352B49689BC9E41738CE4A
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  collectiondiscoveryexecutiondonutloadervipkeyloggerkeyloggerloaderpersistencespywarestealer

  • Detects DonutLoader

    loader

  • Family: DonutLoader

    DonutLoader is a position-independent code that enables in-memory execution of VBScript, JScript, EXE, DLL files and dotNET assemblies.

    loaderdonutloader

  • Family: VIPKeylogger

    VIPKeylogger is a keylogger and infostealer written in C# and it resembles SnakeKeylogger that was found in 2020.

    stealerkeyloggervipkeylogger

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Reads user/profile data of local email clients

    Email clients store some user data on disk where infostealers will often target it.

    spywarestealer

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Accesses Microsoft Outlook profiles

    collection

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

    discovery
  behavioral1behavioral2