Extracted

• • Target
    NEW_PO_NOVA_TRADE.js
  • Size 3.2MB
  • SHA256 4e01506195fae2b2bd8e8b04ff51985abd42bd06fcfcfaf9bea9f9184d1f5388
  • MD5 e5044024d3049e806f3b7bf3025a8b6b
  • SHA1 42c0288f8bd96701a90fadb5fba8ca5375acd180
  • SHA512 d693366c25b8491c8c3c2af50d4ceff46233073b9420b393675a1dbbe6455e0564dc34b4b88a16166987bc26bf0ea0f2ce28ceab6f21edd876748fa17a3a71f5
  • SSDEEP 98304:j3rhC48JWzy2B2PCq4nctSE5C3yMW9eqwadBinmmKjlqQxIJa6cWp/b9YH8nppZ+:j3448JWzuNTimqQOg6X9YgNPAairdLQ0
  • TLSH
    T158F5931ECF329E9A38A91ECC3E65C5D196DEFB4AC1747DCB63519A10E3684D148CEA30
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  discoveryexecutionagenttesladonutloaderkeyloggerloaderspywarestealertrojancollectionpersistenceransomware

  • Detects DonutLoader

    loader

  • Family: AgentTesla

    Agent Tesla is a remote access tool (RAT) written in visual basic.

    keyloggertrojanstealerspywareagenttesla

  • Family: DonutLoader

    DonutLoader is a position-independent code that enables in-memory execution of VBScript, JScript, EXE, DLL files and dotNET assemblies.

    loaderdonutloader

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Reads WinSCP keys stored on the system

    Tries to access WinSCP stored sessions.

    spywarestealer

  • Reads data files stored by FTP clients

    Tries to access configuration files associated with programs like FileZilla.

    spywarestealer

  • Reads user/profile data of local email clients

    Email clients store some user data on disk where infostealers will often target it.

    spywarestealer

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Accesses Microsoft Outlook profiles

    collection
  behavioral1behavioral2