Extracted

• • Target
    COMPROBANTE DE TRANSFERENCIA.JS.js
  • Size 2.8MB
  • SHA256 c5ada905e0d97815d6a0cdf95e5497047e0dc46cc55f3ac063631087e649671b
  • MD5 3b32e5358d687b865f305bf002713ddc
  • SHA1 41a584d4ca962571f0fae028b67f2f13145a4a08
  • SHA512 ed54a6bb05722dfd5ee3a43e620b2bdb67f307fd6918dea67b907c1e0bf86a5474bcddc78e450029eba6ea057b9fa0fc883218ad48b988b2dd3a286bb4000682
  • SSDEEP 49152:Cl5cuWeb06DjL5+Z3WSvQW9LWIQsKwlxUZZMoqSWWo6fFyGsiWieE0+s5yl27MGj:M5vDjL5HSoW9aYKwcDMrSWWo6fFyGsiO
  • TLSH
    T1B2D5C4912B44D1737B21BBAEA537CE355A0EA00355C1DF08322DE608766DD4FA39CEE6
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  collectiondiscoveryexecutionagenttesladonutloaderkeyloggerloaderspywarestealertrojan

  • Detects DonutLoader

    loader

  • Family: AgentTesla

    Agent Tesla is a remote access tool (RAT) written in visual basic.

    keyloggertrojanstealerspywareagenttesla

  • Family: DonutLoader

    DonutLoader is a position-independent code that enables in-memory execution of VBScript, JScript, EXE, DLL files and dotNET assemblies.

    loaderdonutloader

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Reads user/profile data of local email clients

    Email clients store some user data on disk where infostealers will often target it.

    spywarestealer

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Accesses Microsoft Outlook profiles

    collection

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

    discovery
  behavioral1behavioral2