Extracted

• • Target
    PO-DMBK-I-10286.js
  • Size 2.5MB
  • SHA256 a3090f8b58dfea30b272b1fbb76720813e946c7de42ddc9e61bca8f1f29346ea
  • MD5 2af1d3f7eccc2912182b1dfa9c2c0c52
  • SHA1 6db2a9eab152d271a9b4c32108833a6b463f8e6b
  • SHA512 fc805a2bd3811ba44c86efaa4677805993f5230eb7405d9cbad4bc5c68174cfe469d828555961ad7c0f7935a66bd1136d603d4d1e73f8239930a1157587c2f5b
  • SSDEEP 49152:kd++pKzqwyUmib7WZ/3b/B7hxWnz83U7JNa5pEXNyuqQIjKi7ZCg9do7MFrVQoTy:kdDpKGwHmib7WZ/L/B7hxWnz83U7/a5Y
  • TLSH
    T10CC5DEEB44516F3061A97D6CBB3A0EB9E5019D474AC882F505D6530371C26FAECCACBE
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  collectiondiscoveryexecutionagenttesladonutloaderkeyloggerloaderpersistencespywarestealertrojanransomware

  • Detects DonutLoader

    loader

  • Family: AgentTesla

    Agent Tesla is a remote access tool (RAT) written in visual basic.

    keyloggertrojanstealerspywareagenttesla

  • Family: DonutLoader

    DonutLoader is a position-independent code that enables in-memory execution of VBScript, JScript, EXE, DLL files and dotNET assemblies.

    loaderdonutloader

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Reads WinSCP keys stored on the system

    Tries to access WinSCP stored sessions.

    spywarestealer

  • Reads data files stored by FTP clients

    Tries to access configuration files associated with programs like FileZilla.

    spywarestealer

  • Reads user/profile data of local email clients

    Email clients store some user data on disk where infostealers will often target it.

    spywarestealer

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Accesses Microsoft Outlook profiles

    collection
  behavioral1behavioral2