Extracted

• • Target
    Documentos de embarque – BL e PL.JS.js
  • Size 2.9MB
  • SHA256 b728b4aafc56b68bcc8dd300cd155c65a586942fca65c84df573b03a5f24d6d0
  • MD5 f0725c8ebbbbe37e01efb01e1972ba3b
  • SHA1 74bb178568f030c5f6b4a55155b7ab47f0c16b9e
  • SHA512 4675744aaed9297d8b947d855feaf5636b5cc99576b19dc44f0def99d113521b253fe1b3f554336d047095e81dc435d30bca2919c6cd456f325ee19bd119bf4c
  • SSDEEP 49152:/5QHmKZGDLM9UeqvBhZuQm8TnWZWae8WVNntaz9irFHDlPtKc6ByXMWsu04xw+Ot:/56mKW8UeqvBuQm8TWsae8WVNntaz9iY
  • TLSH
    T1EFE5F6922B8492B27B20BFAD653ACE319A0EA01329D1DF10B15DE609371DD4F6358FD7
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  discoveryexecutiondonutloadervipkeyloggerkeyloggerloaderstealercollectionspyware

  • Detects DonutLoader

    loader

  • Family: DonutLoader

    DonutLoader is a position-independent code that enables in-memory execution of VBScript, JScript, EXE, DLL files and dotNET assemblies.

    loaderdonutloader

  • Family: VIPKeylogger

    VIPKeylogger is a keylogger and infostealer written in C# and it resembles SnakeKeylogger that was found in 2020.

    stealerkeyloggervipkeylogger

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Reads user/profile data of local email clients

    Email clients store some user data on disk where infostealers will often target it.

    spywarestealer

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Accesses Microsoft Outlook profiles

    collection

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

    discovery
  behavioral1behavioral2