Extracted

• • Target
    INV 83467_12899.JS.js
  • Size 3.2MB
  • SHA256 170a3b6c18e1e7974f7030929ceec8a2aab1e509fc80e0fad75f48b3ef868baf
  • MD5 081ebb2eada4299186af760aefaeb75e
  • SHA1 b0fbf376d3c50a292fe9750049e4adf9dc05e1b2
  • SHA512 b24543cc6b1285ffa0c88881adce2be62b778522bb8b9fb07f7ff3b88156323d5d2e2afd3298c9441053990e89b50b8b88fec3d9f55489ed6ca942e98634a4ec
  • SSDEEP 98304:d281xI8Okj9MfxKzYg91JnteEzPP4qFXBVgjAeuh8XL48I31015+GZ4:d281dOSFteEzPN1iYeK
  • TLSH
    T19AF5A45A9388A1337B20676CA3B6DE389809B2C734D5CB95396CD2093B7CD07535CADB
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  collectionexecutionagenttesladonutloaderkeyloggerloaderspywarestealertrojan

  • Detects DonutLoader

    loader

  • Family: AgentTesla

    Agent Tesla is a remote access tool (RAT) written in visual basic.

    keyloggertrojanstealerspywareagenttesla

  • Family: DonutLoader

    DonutLoader is a position-independent code that enables in-memory execution of VBScript, JScript, EXE, DLL files and dotNET assemblies.

    loaderdonutloader

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Reads WinSCP keys stored on the system

    Tries to access WinSCP stored sessions.

    spywarestealer

  • Reads data files stored by FTP clients

    Tries to access configuration files associated with programs like FileZilla.

    spywarestealer

  • Reads user/profile data of local email clients

    Email clients store some user data on disk where infostealers will often target it.

    spywarestealer

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Accesses Microsoft Outlook profiles

    collection
  behavioral1behavioral2