Extracted

• • Target
    MV HOANG ANH 12.JS.js
  • Size 5.2MB
  • SHA256 f1a5eb8a4f7f44f6202b7416025de0b60deb09c3e5cf64de74809ee73452c6de
  • MD5 2abaf7d0ee8480a96055630ec16ecd1b
  • SHA1 585ae3a3a95797fb3b607b840e25a16ba2a89f5e
  • SHA512 0bdbe2b9fbfcb7c29693ce2b616b4d538e56dd222d199d1c8b45c586aa4693fc6d8c6aaac9e9f6c485781b977bfe2976d5386c5d7fc86094bfa922df39d7b3bf
  • SSDEEP 98304:wBtXSga3vdSwSemvY0uJ4vcxpC2214i1O25QHiRslmupIysBwrj3k9ENMg9A3Hv7:6tCf8eiY0u+vcxpj214QO25QHiRslmuI
  • TLSH
    T14846FF7F234276783A2DDB1FC1E55D109B16A0673944AE38393CA11777EE603A22C5BB
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  collectiondiscoveryexecutiondonutloadervipkeyloggerkeyloggerloaderpersistencespywarestealer

  • Detects DonutLoader

    loader

  • Family: DonutLoader

    DonutLoader is a position-independent code that enables in-memory execution of VBScript, JScript, EXE, DLL files and dotNET assemblies.

    loaderdonutloader

  • Family: VIPKeylogger

    VIPKeylogger is a keylogger and infostealer written in C# and it resembles SnakeKeylogger that was found in 2020.

    stealerkeyloggervipkeylogger

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Reads user/profile data of local email clients

    Email clients store some user data on disk where infostealers will often target it.

    spywarestealer

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Accesses Microsoft Outlook profiles

    collection

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

    discovery
  behavioral1behavioral2