Extracted

• • Target
    Order 390090.js
  • Size 2.9MB
  • SHA256 078588ba9d4020c691da2d3424b910251062837a70b912e5f9054b03b16b2ab8
  • MD5 c7148b9a1e845a314004ff7f5cb65823
  • SHA1 ea398693d2fab1da5f33c270e8d50f8d214e797b
  • SHA512 4e7297c426fdb4581d6071200489a704de2fb19add9cf50bb30e01cadfe548c02015126d25441f2eb11361c42888f639f8975d4d812437a833f850a3d10b18da
  • SSDEEP 49152:j62aF+a1ZvdLlW2dIdNxck7D+TiUrQytGev/2qImJFU/aqgVns8TY9Ut1UydWW6i:j62aF+a1ZvdLA2dIdNxck7aTiUsyEevj
  • TLSH
    T13AE5872FC6286F1D36E61DCE5E96C2D8A6CFD909C04C4ED37652B951E3348E9C7893A0
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  discoveryexecutiondonutloadermassloggerloaderspywarestealerpersistenceransomware

  • Detects DonutLoader

    loader

  • Family: DonutLoader

    DonutLoader is a position-independent code that enables in-memory execution of VBScript, JScript, EXE, DLL files and dotNET assemblies.

    loaderdonutloader

  • Family: MassLogger

    Masslogger is a .NET stealer targeting passwords from browsers, email and cryptocurrency clients.

    stealerspywaremasslogger

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

    discovery
  behavioral1behavioral2