Extracted

Extracted

• • Target
    NUSKAITYTI _NRB2026000373_2589600_(139618)_2026-10-15_00173935 (02)..JS.js
  • Size 9.9MB
  • SHA256 e6d95e84a81bc18aa024206c6d586af76518366e8ef2c847dcef21342ebd80ea
  • MD5 d633da1e1af13a644e0af9917e0216a6
  • SHA1 9303abf630f05ebf67d1b97caf783ed5b563a2b8
  • SHA512 bd24bb048af56aeba52d6f04623a4382f909bed937bda75d4d4207d631ec8f1541114163d3ee9b7907181d57d42ea6e9e7f9e0ae6fe6349e777ea05e8ddae83d
  • SSDEEP 196608:f9zaPxflKsFBeWBDQgecpXDgLQaP/D9Wdeljx58U8+nEgFH7oOdf81fMmLE0nQyh:fgP8kEL59WdelP8H+Eqbb8txLE0JvQuj
  • TLSH
    T14DA6295A1766957233219BDC47B6CC30A95E246325C5CF2071AEE3487B2CC4FA39DEE2
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  collectiondiscoveryexecutiondonutloaderphantom_stealerloaderpersistencespywarestealer

  • Detects DonutLoader

    loader

  • Family: DonutLoader

    DonutLoader is a position-independent code that enables in-memory execution of VBScript, JScript, EXE, DLL files and dotNET assemblies.

    loaderdonutloader

  • Family: PhantomStealer

    Phantom Stealer is a stealer written in C#, forked from the Stealerium family.

    stealerphantom_stealer

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Accesses Microsoft Outlook profiles

    collection

  • Adds Run key to start application

    persistence

  • Suspicious use of SetThreadContext

  behavioral1behavioral2