Extracted

• • Target
    info_New_Order_7132026 _PDF.shtml(~99 KB).JS.js
  • Size 3.2MB
  • SHA256 59bb8229fb059a3a65dcd25cb1997e0fddaa90b8cf76bfceb351dc481bb81bee
  • MD5 d61cdf5fc94b0d581ce32adcf7fa1406
  • SHA1 31b9e1ccd9f6d9f875f037602c8b09468be42cff
  • SHA512 e3292e57081e81a078f620310163fca727ed81168a72c4ed8b7ec7baffd3db7002fd2bc4405c7d8a1ba8fabe1e2abd0fa1d8b2dd2102b28620f0ce781e454349
  • SSDEEP 98304:f4ArjnhdpVU1FvWQ2zxamHLYP9ic9uhrY5lq8mw/:zjnFehqxamHnKX/
  • TLSH
    T1A3F56C0207469163E5B81A7896096BDFDA3ACA173D849E073AFC558F5FECF04F29852C
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  collectiondiscoveryexecutionagenttesladonutloaderkeyloggerloaderpersistencespywarestealertrojan

  • Detects DonutLoader

    loader

  • Family: AgentTesla

    Agent Tesla is a remote access tool (RAT) written in visual basic.

    keyloggertrojanstealerspywareagenttesla

  • Family: DonutLoader

    DonutLoader is a position-independent code that enables in-memory execution of VBScript, JScript, EXE, DLL files and dotNET assemblies.

    loaderdonutloader

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Reads user/profile data of local email clients

    Email clients store some user data on disk where infostealers will often target it.

    spywarestealer

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Accesses Microsoft Outlook profiles

    collection

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

    discovery
  behavioral1behavioral2