Extracted

• • Target
    Payment Advice.JS
  • Size 2.8MB
  • SHA256 6d458f7fb1a392a9003c373d7a26b1057a3be1dad12bd38115b6a306c53f03df
  • MD5 9a65d095aa35b813066d592c231de57e
  • SHA1 3e5a65e4343740e3538f63032033c041db67c6fd
  • SHA512 41fce8a03144a4414a5c2be7b10276326fb624969e864e1dcdacf68319117ec4a4fe6c316b18251b5db0ed7bd3f768d9658954327d9ef970bfe45776e35500a8
  • SSDEEP 49152:/IMMPnIrbj3YEqwAmhkMy28ZBvmTuYcJVwGCiIx6FBOZr0f6FTJx9pfpng7czzYe:/IfIvj3yMy28ZBvm21Ci06FBOZr0f6FB
  • TLSH
    T11BD5F791674881727B39ABADD53A8E358A0EA00355C1EF0C316DE344B75DE8F635CEE2
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  collectiondiscoveryexecutionagenttesladonutloaderkeyloggerloaderspywarestealertrojan

  • Detects DonutLoader

    loader

  • Family: AgentTesla

    Agent Tesla is a remote access tool (RAT) written in visual basic.

    keyloggertrojanstealerspywareagenttesla

  • Family: DonutLoader

    DonutLoader is a position-independent code that enables in-memory execution of VBScript, JScript, EXE, DLL files and dotNET assemblies.

    loaderdonutloader

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Reads user/profile data of local email clients

    Email clients store some user data on disk where infostealers will often target it.

    spywarestealer

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Accesses Microsoft Outlook profiles

    collection

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

    discovery
  behavioral1behavioral2