Extracted

Extracted

• • Target
    Rechnung und Kostenvoranschlag.JS
  • Size 9.1MB
  • SHA256 d704c8f0869ec2026e2361b8d7de62a47f0c3c2fcecd65a15d1aef5b500b2a1b
  • MD5 d8587f28f712c8bf08a7f5dbc6b9812e
  • SHA1 3d353e8d8b9ac7ac7551434990a3915d2db0e208
  • SHA512 c3b146e2b72f9aab8e9693d4d179937a7cbb3d4a5b34538341311203a43148afa26ebd4aa8b95efa10cbadf34e6f40cb685134628be3a0ffd9907fb228a0432f
  • SSDEEP 196608:LQGQLvvGIiGQ0hhp6/mIq9WHC9t1yA8wYphK6CFtmdBqTki6lvvd+gz+69C2UQa6:tIv+AQ0xbt9TIoYX6WvvEM+6VnrZMnL6
  • TLSH
    T193A619AA135896327B259B8C923ACD31A58E715364D5CF38319DF2187B5CC0BB38D9E3
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  collectiondiscoveryexecutiondonutloaderphantom_stealerloaderpersistencespywarestealer

  • Detects DonutLoader

    loader

  • Family: DonutLoader

    DonutLoader is a position-independent code that enables in-memory execution of VBScript, JScript, EXE, DLL files and dotNET assemblies.

    loaderdonutloader

  • Family: PhantomStealer

    Phantom Stealer is a stealer written in C#, forked from the Stealerium family.

    stealerphantom_stealer

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Accesses Microsoft Outlook profiles

    collection

  • Adds Run key to start application

    persistence

  • Suspicious use of SetThreadContext

  behavioral1behavioral2