Extracted

Extracted

• • Target
    7adba5e80bc94fddc74d059572cf7a67501a7c82a33afc7a3f66fa08a0a8c54c.js
  • Size 2.7MB
  • SHA256 7adba5e80bc94fddc74d059572cf7a67501a7c82a33afc7a3f66fa08a0a8c54c
  • MD5 da484213be30cc1ac0d4ba669e59d4db
  • SHA1 2d9d41d5e278655774c8bfe96f0fcea61ed4fd6d
  • SHA512 03f6f92b948e3e3d51ab8d99fd27be38dd6a60da74261787b93abc848ba828aa66b56d3dd2a317caeff33a559c7088d487e68f6f53607b2afa101bb34c350618
  • SSDEEP 1536:QUtW9tWzPGWUrT6HOIoqJRdq89j2wyPsvqjqRb8AB/Oa9NJ9z02qTv6Mnr8bX0QX:Qe
  • TLSH
    T107D5D7E7E3DC4BAF669448E98119351764E2C17B2C6F5348A9D2190BB33FD107A27BB0
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  js-cryptercollectiondefense_evasiondiscoveryexecutionasyncratdonutloaderphantom_stealerloaderpersistenceratspywarestealer

  • Async RAT payload

    rat

  • Detects DonutLoader

    loader

  • Family: AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Family: DonutLoader

    DonutLoader is a position-independent code that enables in-memory execution of VBScript, JScript, EXE, DLL files and dotNET assemblies.

    loaderdonutloader

  • Family: PhantomStealer

    Phantom Stealer is a stealer written in C#, forked from the Stealerium family.

    stealerphantom_stealer

  • Command and Scripting Interpreter: PowerShell

    Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

    execution

  • Command and Scripting Interpreter: PowerShell

    Run Powershell and hide display window.

    execution

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Accesses Microsoft Outlook profiles

    collection

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

    discovery
  behavioral1behavioral2