Extracted

• • Target
    01 SEPT DUBAI LAB QUOTE 2026.JS
  • Size 3.7MB
  • SHA256 7e7c66272b7ed8cee313b9f6210c73fa071618954498ccfc6481c3bf11cc4b82
  • MD5 10dc46cd5be928b99f957ab6be1d549b
  • SHA1 1453376d8c1a98727dcc017c582de7407f845be7
  • SHA512 89a0e67d3a52ab0820bb028daae4c877317ab955e354a96796ce9a2ed23d9717588b0dbbb3dd2c6b548438b95170763b0e3683dd267e1e68f163fee8226d797d
  • SSDEEP 98304:bS9xur54ixTp1RZ+VQJDEoUUQTG/w5WtEJ/C8AqV4EAD3DPPb:kWtSq8tJAzPb
  • TLSH
    T1280660F045656E32F42CF62EC1398AF8673A190B0AB5E90FB6787152D7EDB06B04E4D1
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  collectionexecutionagenttesladonutloaderkeyloggerloaderspywarestealertrojan

  • Detects DonutLoader

    loader

  • Family: AgentTesla

    Agent Tesla is a remote access tool (RAT) written in visual basic.

    keyloggertrojanstealerspywareagenttesla

  • Family: DonutLoader

    DonutLoader is a position-independent code that enables in-memory execution of VBScript, JScript, EXE, DLL files and dotNET assemblies.

    loaderdonutloader

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Reads WinSCP keys stored on the system

    Tries to access WinSCP stored sessions.

    spywarestealer

  • Reads data files stored by FTP clients

    Tries to access configuration files associated with programs like FileZilla.

    spywarestealer

  • Reads user/profile data of local email clients

    Email clients store some user data on disk where infostealers will often target it.

    spywarestealer

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Accesses Microsoft Outlook profiles

    collection
  behavioral1behavioral2