Extracted

• • Target
    remittance slip.pdf.JS
  • Size 3.6MB
  • SHA256 e88d22a19be2f21a607af003e04d510f4b761a96e7787d5343ddacd42a949fd1
  • MD5 9d8521315cbeb62792bdb3f01da2c9e3
  • SHA1 b9381db24fff2f07ea0330d412ff131417a9a8ec
  • SHA512 d8689b536680562bd5e96310da98ea0eed5e1fd1884e3429e2dde382f9a54408a454678bf2bed7676db0c78b537470f2e7071886c8e30913b93062b7daa61f77
  • SSDEEP 98304:KCpuNALueV9E7AYx4pU8yPEnTlU8ZnyxKthHb66LfVy7vqn+l:zpuNJQnhpnJL66LfU7l
  • TLSH
    T11606B4816705E530AAAC6F2CF6765534690C23C741C8AF2D307C870A77B79A7637C9EA
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  collectiondiscoveryexecutionagenttesladonutloaderkeyloggerloaderspywarestealertrojan

  • Detects DonutLoader

    loader

  • Family: AgentTesla

    Agent Tesla is a remote access tool (RAT) written in visual basic.

    keyloggertrojanstealerspywareagenttesla

  • Family: DonutLoader

    DonutLoader is a position-independent code that enables in-memory execution of VBScript, JScript, EXE, DLL files and dotNET assemblies.

    loaderdonutloader

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Reads user/profile data of local email clients

    Email clients store some user data on disk where infostealers will often target it.

    spywarestealer

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Accesses Microsoft Outlook profiles

    collection

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

    discovery
  behavioral1behavioral2