Extracted

• • Target
    見積請求書.JS
  • Size 2.8MB
  • SHA256 4d2d933833407d7a57ca47402808a1d79e22f5cffda0d4bd35177669e987d867
  • MD5 7e4c1d09d68f95bee7fc820f12c9007a
  • SHA1 e98db53888203fe6e2eac4b336252478c33148bd
  • SHA512 8a72e6fe77193a26ae7b724a84b2eaf69a57bb01d991698e9589ab6ce6d6dae690b2ff53077a8f6cd00b8417e30f4976af55677cf9b76c4eed3932c484c1f842
  • SSDEEP 49152:M18D/Ang6nMyIj04ZsC3yHThH7eAVU4gabpqapefHF/Fh28ePSiy5jPj9TgeGpN:M2D/Angsyj04ZsC3yHThbeAVdgabpqaT
  • TLSH
    T19AD5E5912744D0727B21ABAC61378E319A0FA09355D2DF19316CE30877ADD4FA39CEE6
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  collectiondiscoveryexecutionagenttesladonutloaderkeyloggerloaderspywarestealertrojan

  • Detects DonutLoader

    loader

  • Family: AgentTesla

    Agent Tesla is a remote access tool (RAT) written in visual basic.

    keyloggertrojanstealerspywareagenttesla

  • Family: DonutLoader

    DonutLoader is a position-independent code that enables in-memory execution of VBScript, JScript, EXE, DLL files and dotNET assemblies.

    loaderdonutloader

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Reads user/profile data of local email clients

    Email clients store some user data on disk where infostealers will often target it.

    spywarestealer

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Accesses Microsoft Outlook profiles

    collection

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

    discovery
  behavioral1behavioral2