Extracted

• • Target
    FSD987654567800098765456.JS
  • Size 3.7MB
  • SHA256 2dbed107127b850e1efa948bb74158a7adc3b0446baa91f7d5ac4ac32b798c2a
  • MD5 2938144bc2ed080bf5269e34f963d94e
  • SHA1 fa5131487abab3f0bf4419027fb74478014831a6
  • SHA512 da9227137c5fb9fde70aa3082d9e581e552eb3555dbf553e06150055e99812664629435aeefca7a4d1b33a6ed0423cf52f099a1b4baec3daf447afeaf491361c
  • SSDEEP 98304:nT/LZDQDP+syc5CgZ4CfMiRVXCgN0RE0bENsYgnX8kWUD6WPab1oYqU4AGKWbOy2:KznMgSexRVSgN0RELeWE6WPaFB+bOu/q
  • TLSH
    T1B3064ACC9C3B62A218A825084FE55F976D31863F3510D9B9F9FE7D997B04F0CA286D12
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  collectiondiscoveryexecutiondonutloadervipkeyloggerkeyloggerloaderpersistencespywarestealer

  • Detects DonutLoader

    loader

  • Family: DonutLoader

    DonutLoader is a position-independent code that enables in-memory execution of VBScript, JScript, EXE, DLL files and dotNET assemblies.

    loaderdonutloader

  • Family: VIPKeylogger

    VIPKeylogger is a keylogger and infostealer written in C# and it resembles SnakeKeylogger that was found in 2020.

    stealerkeyloggervipkeylogger

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Reads user/profile data of local email clients

    Email clients store some user data on disk where infostealers will often target it.

    spywarestealer

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Accesses Microsoft Outlook profiles

    collection

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

    discovery
  behavioral1behavioral2