Extracted

Extracted

• • Target
    Quote QU-48922.JS
  • Size 3.7MB
  • SHA256 3e526d038238bcec2238d7ca14df8d1394fbb15c8b0ff7a58c84b924b5b2b99a
  • MD5 b2b11c1f09062f6524ef9975e0b76e08
  • SHA1 f3d4c5a6f076e653f1419a083ecd834a59de39e4
  • SHA512 d166c45ab5c5f77ca0194e6857209d25a00875eee2fd018a30e11118c53bef45228b881ce412f2ccbd51c5ccece5823c4981433229df51fa5b4a39ce180de99a
  • SSDEEP 98304:afb8ojr/gZsRFDjRRwKwalW0RD2iE3a/u6Ne7QhMSkz7FXx0M0D8P4pwFh+Qyf:afb8oX/GsnRRDl32iEKGo7MSkzEyFh+F
  • TLSH
    T18106E751A354D472B27EA76CC136CE214569229710C9EF2E30BD430CB7AA93B635CEF6
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  collectiondiscoveryexecutiondonutloaderphantom_stealerloaderpersistencespywarestealer

  • Detects DonutLoader

    loader

  • Family: DonutLoader

    DonutLoader is a position-independent code that enables in-memory execution of VBScript, JScript, EXE, DLL files and dotNET assemblies.

    loaderdonutloader

  • Family: PhantomStealer

    Phantom Stealer is a stealer written in C#, forked from the Stealerium family.

    stealerphantom_stealer

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Accesses Microsoft Outlook profiles

    collection

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

    discovery
  behavioral1behavioral2