Extracted

Extracted

• • Target
    Enquiry-SSJ25048.JS
  • Size 1.9MB
  • SHA256 36bcadfb4ec48f22b12f034a5d3567f976860c4dc7f970514a958f0030992e56
  • MD5 3d4db6b2938392e754068a90e405753b
  • SHA1 6e74937aace13fb7c269a7309680348b7c998727
  • SHA512 05fa811c7eb59bb5515ba2ef5451db29a501e162a8cb3144c00ca3251836e3b899852e24bbe9978f5a3e8b7114157a16aaa82da15a37c85756160ab514357010
  • SSDEEP 24576:ns8TLBeV7OpKZNWkFcrSxfVEmuv4vS6KleSFPB+orbYHLhyemhrvQUs5TdbXX:ns8TLBeLNWkim1y85KRBPY9yezdbXX
  • TLSH
    T1CB95A1FF2B3EEA03D41DA31273F95AE3CF58580E5357599CA80AE48C675E6C006D9C92
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  collectiondiscoveryexecutiondonutloaderphantom_stealerloaderpersistencespywarestealerransomware

  • Detects DonutLoader

    loader

  • Family: DonutLoader

    DonutLoader is a position-independent code that enables in-memory execution of VBScript, JScript, EXE, DLL files and dotNET assemblies.

    loaderdonutloader

  • Family: PhantomStealer

    Phantom Stealer is a stealer written in C#, forked from the Stealerium family.

    stealerphantom_stealer

  • Badlisted process makes network request

    Network request originating from process or tool commonly abused by malware.

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Accesses Microsoft Outlook profiles

    collection

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

    discovery
  behavioral1behavioral2