Extracted

• • Target
    Payment Details.JS.js
  • Size 11.4MB
  • SHA256 d6e4ea76ee3057452937e7af5dc15a8fae0edcd6af0c032a6cb3cad3b0a03301
  • MD5 b9235cd506ca71c00b2cf1d03b0ef713
  • SHA1 7a72fccdd3ed82257b56821d23e112b0f0f18553
  • SHA512 c7c35e0fbf42c6b8d27f45faacdc4e6d194e0a9de76526fea184cde059defeb35f6aadea23d552a8c4c28fe7036c8588181a6750a404704a4025e8d3dacf7c45
  • SSDEEP 196608:16sgaDGNbxQEJgkIfEWtX/f0ieY87wg9Y:9D0xvJgkIEWv8Y
  • TLSH
    T17BC6F88E5388A6327730574C6277CD38994A612324C5FB95367CE7087B7DE07A39CAE2
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  collectiondiscoveryexecutiondonutloaderphantom_stealerloaderspywarestealer

  • Detects DonutLoader

    loader

  • Family: DonutLoader

    DonutLoader is a position-independent code that enables in-memory execution of VBScript, JScript, EXE, DLL files and dotNET assemblies.

    loaderdonutloader

  • Family: PhantomStealer

    Phantom Stealer is a stealer written in C#, forked from the Stealerium family.

    stealerphantom_stealer

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Accesses Microsoft Outlook profiles

    collection

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

    discovery
  behavioral1behavioral2