Extracted

• • Target
    Mt103 swift copy.JS
  • Size 3.6MB
  • SHA256 9fd781d549aec0e884a9d90541e8d7e5802d0de0cc36fc9d3c8533deb44846ed
  • MD5 c9ba14c490a2b03289ac12b89172715d
  • SHA1 ae142808be765b3473929a4ffc6151542919fab8
  • SHA512 c8d53b4291e434d0424dd8e80500024683e4efe88b9e67f2695fb5743746a44b70c5e38db7a4d42b588bca3ad7168733d94c80d5d8985c5be506cc44c5320799
  • SSDEEP 98304:G5+CzBn0tdqOB7Hv1c2QS/42uKDdEf3cI:Onc1Hv1ZQSQ2ziMI
  • TLSH
    T1D806494098B0B28B75A4C7AA954F9FF4594E94979D34CD403B0FD63D8D09F8B32922BB
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  collectiondiscoveryexecutionagenttesladonutloaderkeyloggerloaderspywarestealertrojan

  • Detects DonutLoader

    loader

  • Family: AgentTesla

    Agent Tesla is a remote access tool (RAT) written in visual basic.

    keyloggertrojanstealerspywareagenttesla

  • Family: DonutLoader

    DonutLoader is a position-independent code that enables in-memory execution of VBScript, JScript, EXE, DLL files and dotNET assemblies.

    loaderdonutloader

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Reads user/profile data of local email clients

    Email clients store some user data on disk where infostealers will often target it.

    spywarestealer

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Accesses Microsoft Outlook profiles

    collection

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

    discovery
  behavioral1behavioral2