Extracted

• • Target
    info_New_Order_7132026 _PDF.shtml(~99 KB).JS
  • Size 3.6MB
  • SHA256 fe65f79d491a7fedcf1af8d64667c308a5b15ae14b9e4ef57e8a398d588a1b71
  • MD5 0ced152b38cd68c37c94799b6d61bd8c
  • SHA1 9a2cc5e4102f6723d73c8042208ed746fd64358b
  • SHA512 4aaf4be070a33378c41f39f79879b8684dbb1be9a5a7f53d454fcd0a8f6e7c99a1eb6cbe75664ca5d60a3f2bf0b3003638999b6dab99291738e4ab5c9becad18
  • SSDEEP 98304:rpSOQnwSu7vXdIaHhBm2t1TGYbD9yo51SBGQO1jbS6hdew:dFVhBmOlUsvK6h5
  • TLSH
    T1570692C4214CA2427CEE62D78C095BADAF0D620B1D62DB1BB1ECCB797B95B01F1D8D94
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  collectiondiscoveryexecutionagenttesladonutloaderkeyloggerloaderspywarestealertrojan

  • Detects DonutLoader

    loader

  • Family: AgentTesla

    Agent Tesla is a remote access tool (RAT) written in visual basic.

    keyloggertrojanstealerspywareagenttesla

  • Family: DonutLoader

    DonutLoader is a position-independent code that enables in-memory execution of VBScript, JScript, EXE, DLL files and dotNET assemblies.

    loaderdonutloader

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Reads user/profile data of local email clients

    Email clients store some user data on disk where infostealers will often target it.

    spywarestealer

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Accesses Microsoft Outlook profiles

    collection

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

    discovery
  behavioral1behavioral2