Extracted

Extracted

• • Target
    TEC001_DANOHER_PURCHASEORDER_121815_2026071.JS
  • Size 4.7MB
  • SHA256 2c025d944ae359c4140d0d041976e649523d435195418b8cc19d5f7936e1d072
  • MD5 4dee8000b50bc2f57c0f4ae85d6982e6
  • SHA1 8918531987ff05662517d996ded06a72db6e3686
  • SHA512 1d5edbc93d9b3556a8d5e924ec46e310bc0c91cc059fb4b98558064c4b9d09a7efe6e8f50ef61c7f66c20d533034235a293386214d8a6926e012a6f97ac9ca06
  • SSDEEP 98304:xslaXMXYzzryufe4J9zJ46qU/AyRnLjscKA28RI6Mf3uWTqR6Cdl6lgptM6KJg7L:xGaXMID724vJwU/AgnLHwl6Mf3TkXLNT
  • TLSH
    T18436B6864F9184BA7768D78C1A7ADA50834D02A30EDDDB3630BEC9247B5DD47931CACB
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  collectiondiscoveryexecutiondonutloaderphantom_stealerloaderpersistencespywarestealer

  • Detects DonutLoader

    loader

  • Family: DonutLoader

    DonutLoader is a position-independent code that enables in-memory execution of VBScript, JScript, EXE, DLL files and dotNET assemblies.

    loaderdonutloader

  • Family: PhantomStealer

    Phantom Stealer is a stealer written in C#, forked from the Stealerium family.

    stealerphantom_stealer

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Accesses Microsoft Outlook profiles

    collection

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

    discovery
  behavioral1behavioral2