Extracted

• • Target
    Po documents & others.JS.js
  • Size 3.2MB
  • SHA256 5c08270287e5ee97b1e9420e311bd0eb87d12f9ae44ffb05ed2f508aa31abac8
  • MD5 ef7a6fb435747fb637bf5c5fba0077c6
  • SHA1 433305df6921ce9ab9d10d2b0715101a5fdc2aea
  • SHA512 916b99a13bc1f1fd943427428abbfdd560a023c2c3085925a1a7669a48d77b8acb1a31437742f45d54862236bf7d3271e73a39d16eaf81a6bfd2f7a88483c930
  • SSDEEP 98304:yUxuWMxhJiCmuZGhDCoWgizE7MG+fhQgwATcaeO3/BkFLqTzcujf2L5apYqmqCjB:y+uWMxDiCmuZuWgizEovfOkQav5kF+Tg
  • TLSH
    T18AF5D5405BA2A17677297F9C8139EE30E549810310C5CF0A74BDE21DBFADC96D798EE2
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  collectiondiscoveryexecutionagenttesladonutloaderkeyloggerloaderspywarestealertrojan

  • Detects DonutLoader

    loader

  • Family: AgentTesla

    Agent Tesla is a remote access tool (RAT) written in visual basic.

    keyloggertrojanstealerspywareagenttesla

  • Family: DonutLoader

    DonutLoader is a position-independent code that enables in-memory execution of VBScript, JScript, EXE, DLL files and dotNET assemblies.

    loaderdonutloader

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Reads user/profile data of local email clients

    Email clients store some user data on disk where infostealers will often target it.

    spywarestealer

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Accesses Microsoft Outlook profiles

    collection

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

    discovery
  behavioral1behavioral2