Extracted

• • Target
    Quotation 10124657.JS.js
  • Size 10.9MB
  • SHA256 c1ae2ffffdbf2585bc522c6c226557fd8d45d989070fde4939cb039e580dba20
  • MD5 63f7f45c9b5132d9177bd2e97f6b89cf
  • SHA1 3f74a7b9c15ad1c278b67719a89d652d90c9d224
  • SHA512 cffdd238111c756c06080cc49e1651d6e29cd7019846764e5b93ea36372b9c23a3342609e42662e97adc85c8448538bbf40e51c693e431ea0ba04623941fbd28
  • SSDEEP 98304:ucy9FLSg5qJXmlH9HTliTP/X3ItyDcZzpkTKiQcSO0ReNIH1swjM3xO1mksdD5l3:4zUmsHHv6pkT/n+8AKBE+lwIX73
  • TLSH
    T148B691891B069432753D5B1CC2369BA08A09310311C9DBBF327FD3897B71B1B579E9EA
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  collectiondiscoveryexecutionagenttesladonutloaderkeyloggerloaderspywarestealertrojan

  • Detects DonutLoader

    loader

  • Family: AgentTesla

    Agent Tesla is a remote access tool (RAT) written in visual basic.

    keyloggertrojanstealerspywareagenttesla

  • Family: DonutLoader

    DonutLoader is a position-independent code that enables in-memory execution of VBScript, JScript, EXE, DLL files and dotNET assemblies.

    loaderdonutloader

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Reads user/profile data of local email clients

    Email clients store some user data on disk where infostealers will often target it.

    spywarestealer

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Accesses Microsoft Outlook profiles

    collection

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

    discovery
  behavioral1behavioral2