Extracted

Extracted

• • Target
    Bestellungen.JS.js
  • Size 9.6MB
  • SHA256 c4f9eecae66a4567515f065e4564f3558f21abf037fe79820b48bace2f3ec7d8
  • MD5 5a0a89f6f9ec5f381197ef35ed038a25
  • SHA1 c31edd0cd1d63532b208e2690fb28a2cfd25f5ee
  • SHA512 90517c56244c27544a518873f7bfa99fdc99e5268920f6740008dd374d3e3bdc2a838d5d88f2fa44eb787d3ae6ff8c07d52ef6c9fc7c74429758d167b985c276
  • SSDEEP 196608:Uqy8BfbKQgAhIOTJM6kVwHWfroUN3lB30bQUrWMfeDibaVxwSIR7OsFR8wCoZVbH:l9DhIOFM6kVw2DRbAbVqiwxwSIRKsFRZ
  • TLSH
    T180A6F666131492357B219B8DA73AEC30E88FA05356C5CBA431ACF218F79DC4BE3596D3
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  collectiondiscoveryexecutiondonutloaderphantom_stealerloaderpersistencespywarestealer

  • Detects DonutLoader

    loader

  • Family: DonutLoader

    DonutLoader is a position-independent code that enables in-memory execution of VBScript, JScript, EXE, DLL files and dotNET assemblies.

    loaderdonutloader

  • Family: PhantomStealer

    Phantom Stealer is a stealer written in C#, forked from the Stealerium family.

    stealerphantom_stealer

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Accesses Microsoft Outlook profiles

    collection

  • Adds Run key to start application

    persistence

  • Suspicious use of SetThreadContext

  behavioral1behavioral2