Extracted

• • Target
    RFQ AUG12 2026.JS
  • Size 3.2MB
  • SHA256 a8f82c5a5ad3d41ba6ab4f6e71706b99131cd8c7537369bf127ba2d99e83da64
  • MD5 6f0a60d7e4a5bba100fba08eb8cc3691
  • SHA1 9c6dfa9deeb4807b104346c52ca4247379c0d866
  • SHA512 0af3692f7faaf5f293fa4f1306a28b618b60ae1a8fe0c3517749ecffb3c042ba3874054c8ff2881f93cc59388a86c1908a4fe2a0a40531a3612a9c17f86c07ee
  • SSDEEP 98304:lp7XoaS4AwHOSsG0aQDLmKn5XL7qHFbI20sy9vkPBb4PnQHO6E/n:TD84nHOo015XCMTGUYHLEv
  • TLSH
    T196F5C347A272F74EF0A829284E6E1B94593DF6E3F75798033B3C15B60B14FE12365922
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  collectiondiscoveryexecutionagenttesladonutloaderkeyloggerloaderspywarestealertrojan

  • Detects DonutLoader

    loader

  • Family: AgentTesla

    Agent Tesla is a remote access tool (RAT) written in visual basic.

    keyloggertrojanstealerspywareagenttesla

  • Family: DonutLoader

    DonutLoader is a position-independent code that enables in-memory execution of VBScript, JScript, EXE, DLL files and dotNET assemblies.

    loaderdonutloader

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Reads user/profile data of local email clients

    Email clients store some user data on disk where infostealers will often target it.

    spywarestealer

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Accesses Microsoft Outlook profiles

    collection

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

    discovery
  behavioral1behavioral2