Extracted

Extracted

• • Target
    Document 1144322785.JS
  • Size 4.2MB
  • SHA256 db6f1bed81ff7c556132fed2aab07571d8b71358bb3d1be6d2c90db25c4a80f4
  • MD5 fa92c26063dc1e401f8b96d592a68c79
  • SHA1 0f9426af3271bda65a97d0c23d78498b7d2f68a9
  • SHA512 c232bd492647634d27b8eca2307c7a50031e10bad2348e14a9b4423b1e5bfd82abaebd054a88a6352698cd87d14b513dfdb2af75d6cee81fa2f77fa456435307
  • SSDEEP 98304:J51hJLb24t+cnFeDFOMN9+Nc/mnCEwQ7tnXj394T0ip4+YIxI6F:J51hJLbqcnaOMNhSCEw6baT0HyC6F
  • TLSH
    T19D262A8106A045DBA274FB48CE3BF6913BAC79974C30DF4AF6ED8A8D7548D053A2534E
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  collectiondiscoveryexecutiondonutloaderphantom_stealerloaderspywarestealer

  • Detects DonutLoader

    loader

  • Family: DonutLoader

    DonutLoader is a position-independent code that enables in-memory execution of VBScript, JScript, EXE, DLL files and dotNET assemblies.

    loaderdonutloader

  • Family: PhantomStealer

    Phantom Stealer is a stealer written in C#, forked from the Stealerium family.

    stealerphantom_stealer

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Accesses Microsoft Outlook profiles

    collection

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

    discovery
  behavioral1behavioral2