Extracted

• • Target
    Purchase Order.JS
  • Size 2.8MB
  • SHA256 6045d659050d22e1bdd3c6d71186cfc9c32d790a52cadb295ca21406f0fc0220
  • MD5 2e8c01d1f0251e56238e8779fb5d0450
  • SHA1 5c7fb5880d99f33cdd3f3474a63dc0ab28e7054e
  • SHA512 16f0fa8f97916a5ce102a93e318318ad643aecae8e7870ad90ab9198dabc1f0fb766449b1531caf71ef12761fe40cea396dda89aaf741de00977bc86e15f4151
  • SSDEEP 49152:VFaTKgXZT3oyK40mhocOZFQQPwVjiioLDqvbfDi1ACmnaLIt6suXIuwStetYBWfS:VwWqZTYp4LhocOZFQIEvzDi1ACmnaLIM
  • TLSH
    T158D5F7912745D1B37721ABAD663ACF329A0EA00354C1DF04316DE309366DD5FA3ACEE6
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  collectiondiscoveryexecutionagenttesladonutloaderkeyloggerloaderspywarestealertrojan

  • Detects DonutLoader

    loader

  • Family: AgentTesla

    Agent Tesla is a remote access tool (RAT) written in visual basic.

    keyloggertrojanstealerspywareagenttesla

  • Family: DonutLoader

    DonutLoader is a position-independent code that enables in-memory execution of VBScript, JScript, EXE, DLL files and dotNET assemblies.

    loaderdonutloader

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Reads user/profile data of local email clients

    Email clients store some user data on disk where infostealers will often target it.

    spywarestealer

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Accesses Microsoft Outlook profiles

    collection

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

    discovery
  behavioral1behavioral2