Extracted

• • Target
    Purchase Order 4300004882.JS
  • Size 3.6MB
  • SHA256 30db70079173f4b896525f12a772652de859f4c7c9ae38737e6e1b2513a17bdd
  • MD5 b5015b61ccb72593abd8aff2c335fb5e
  • SHA1 7e584123ba2a11cf2fc98c1e08b27093b8c434aa
  • SHA512 0f2da5a66cdfe0d694efd5e0252d842b3d33dbe539e67b936f5dcdde398a870c073d59b802b61ac765118b9174750cb4fde3130981adfa4cc4f29ca863d9e74e
  • SSDEEP 98304:+E6XBgVjhFsWcxZ1+cthgFMFRDkevmp0Hsd5se2z0WtrGKIv:+lXBgVjh0D1+cthgFMzDkey9VKw
  • TLSH
    T15706B6E61791E1327B34774C77778A34A609538305DACB1A302CD2083B7EEAB936DAD5
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  collectiondiscoveryexecutionagenttesladonutloaderkeyloggerloaderspywarestealertrojan

  • Detects DonutLoader

    loader

  • Family: AgentTesla

    Agent Tesla is a remote access tool (RAT) written in visual basic.

    keyloggertrojanstealerspywareagenttesla

  • Family: DonutLoader

    DonutLoader is a position-independent code that enables in-memory execution of VBScript, JScript, EXE, DLL files and dotNET assemblies.

    loaderdonutloader

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Reads user/profile data of local email clients

    Email clients store some user data on disk where infostealers will often target it.

    spywarestealer

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Accesses Microsoft Outlook profiles

    collection

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

    discovery
  behavioral1behavioral2