Extracted

• • Target
    Purchase Order - BHPO26-2790 pdf.JS.js
  • Size 3.2MB
  • SHA256 cd80f4c36a395ae636332270f79eb3e9acc94cc1778bfc55422a7da4ae1dbe69
  • MD5 43c671174e325152d6514317be49181e
  • SHA1 405f9bd26a0298cfbaf696c78b91defca0f98986
  • SHA512 a88e4b989a98f0c5b6797501e4bbf50a8e95471a3ed4b32f62715d6c22dc242df932f98112ed0d7556b32e1a2d617ca042b23a24673bfb8683b20d515c21117f
  • SSDEEP 98304:G5eiF3FdluA2RmpQi/NURAzXq02LOnvf6GGasQzRQ/WkeBin9:AdLuRmHe/0/vfjL7q9
  • TLSH
    T100F5D5A610A0B745FA6A85A94E0F1F444A2EF2C3EB54DCC7372C45ED1F14BC12968BB7
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  collectiondiscoveryexecutionagenttesladonutloaderkeyloggerloaderspywarestealertrojan

  • Detects DonutLoader

    loader

  • Family: AgentTesla

    Agent Tesla is a remote access tool (RAT) written in visual basic.

    keyloggertrojanstealerspywareagenttesla

  • Family: DonutLoader

    DonutLoader is a position-independent code that enables in-memory execution of VBScript, JScript, EXE, DLL files and dotNET assemblies.

    loaderdonutloader

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Reads user/profile data of local email clients

    Email clients store some user data on disk where infostealers will often target it.

    spywarestealer

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Accesses Microsoft Outlook profiles

    collection

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

    discovery
  behavioral1behavioral2