Extracted

• • Target
    CONFIRMACIÓN DE PAGO ...JS.js
  • Size 3.3MB
  • SHA256 481da3385f56da090d07550a9c381a7822f511edcf6ece1775645d7d6a622398
  • MD5 5c76eea27ed1fa0e918e067ae3161ac6
  • SHA1 655f18cec09634d24ca93d678db64aa11c9b9e2d
  • SHA512 43fda935edb21fa8b10f0eb36d2b01ba84bca46b2290bbea38f27f1b10405803c3514696458c0973d2f40a8347fe8a25d90027835a057e4205b5e32861520ab5
  • SSDEEP 98304:wxr8L/Gpyrdlzs/H4ah5UzwIKnpVM2i1x0B+XmZyg5PeHJrye7mI:wu/G7H4kekux0MX4TqZyeaI
  • TLSH
    T15FF5A440134895367222B74CA5BB9BB0A91A638314C5CF1532ACD258FFBED07535AFEB
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  discoveryexecutiondonutloadervipkeyloggerkeyloggerloaderstealercollectionspyware

  • Detects DonutLoader

    loader

  • Family: DonutLoader

    DonutLoader is a position-independent code that enables in-memory execution of VBScript, JScript, EXE, DLL files and dotNET assemblies.

    loaderdonutloader

  • Family: VIPKeylogger

    VIPKeylogger is a keylogger and infostealer written in C# and it resembles SnakeKeylogger that was found in 2020.

    stealerkeyloggervipkeylogger

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Reads user/profile data of local email clients

    Email clients store some user data on disk where infostealers will often target it.

    spywarestealer

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Accesses Microsoft Outlook profiles

    collection

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

    discovery
  behavioral1behavioral2