Extracted

• • Target
    Factura No 3319786.JS.js
  • Size 3.3MB
  • SHA256 12de494db7efffd346e9c434950c72da25b8cd3f71b5d326870ef275c202cbbe
  • MD5 fbbffaa1962ecfa57bdfb033d70b1510
  • SHA1 95248573d29218e0d21d78a7b643c61878acf51c
  • SHA512 0ada0ef40730eea5e55ea90643883ce271fe62c3ef133c4baa19f6d8e1f161f33322e274c14568151624bbc3586bea41118acff76b1d1b250789d8d17f816528
  • SSDEEP 98304:5jpR5H3jAjH8S19FqGQAGUsdk8Dy3PWVgjgpJ9Md1sIrBbRlVdPbTqumCU:5jpRZjAjH8SnFqGQd286PWajginsmz/0
  • TLSH
    T1D3F583803B4499737B225B6C4E379922E80D598324C6DB153E6CDA0877BCD97D3D8AE3
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  collectiondiscoveryexecutiondonutloadervipkeyloggerkeyloggerloaderspywarestealer

  • Detects DonutLoader

    loader

  • Family: DonutLoader

    DonutLoader is a position-independent code that enables in-memory execution of VBScript, JScript, EXE, DLL files and dotNET assemblies.

    loaderdonutloader

  • Family: VIPKeylogger

    VIPKeylogger is a keylogger and infostealer written in C# and it resembles SnakeKeylogger that was found in 2020.

    stealerkeyloggervipkeylogger

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Reads user/profile data of local email clients

    Email clients store some user data on disk where infostealers will often target it.

    spywarestealer

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Accesses Microsoft Outlook profiles

    collection

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

    discovery
  behavioral1behavioral2