Extracted

• • Target
    Detalles de los recibos de pago.JS.js
  • Size 2.8MB
  • SHA256 a350ab3e8b5c27a43323b0c05bcf9a216d3702778a44763e50303bf5b5bcb26b
  • MD5 fa1fbc97e4a691b9ec18a849b7823199
  • SHA1 3e8eaa0136306314dd9817bc142398ee8ed5caee
  • SHA512 703d26d2b3f092692f4f52d6441a420b370783df3ff9fd0785f6af006122ae19550ad5e4c34ffaeccf48f2a9d04017e55a527883d1fa55f357d4a7b49eebcb91
  • SSDEEP 49152:DgZiXxViMqayyiAM6PdAem/MhX5oIrx84nUiIkwWzioeH8bhPlKttLzn4M6XJ:DkiXSUyyiAM6PdAebhXmIrxfUmwWziof
  • TLSH
    T163D5E781678485737721ABAC523ADE319E0EB00368C6EF45312DE708366DD5FA35CEE6
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  collectiondiscoveryexecutionagenttesladonutloaderkeyloggerloaderspywarestealertrojan

  • Detects DonutLoader

    loader

  • Family: AgentTesla

    Agent Tesla is a remote access tool (RAT) written in visual basic.

    keyloggertrojanstealerspywareagenttesla

  • Family: DonutLoader

    DonutLoader is a position-independent code that enables in-memory execution of VBScript, JScript, EXE, DLL files and dotNET assemblies.

    loaderdonutloader

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Reads user/profile data of local email clients

    Email clients store some user data on disk where infostealers will often target it.

    spywarestealer

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Accesses Microsoft Outlook profiles

    collection

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

    discovery
  behavioral1behavioral2