Extracted

• • Target
    28102026_0332_22102026_New Order YS2610L108.tar.js
  • Size 2.9MB
  • SHA256 bf18bf9721f054f6d983576917a2f958087aa7d1044fb0ba4dd11ff0b242db98
  • MD5 77332d525c059c9e34fb4306073eb06e
  • SHA1 554f236021d2a756ecfb9e3394442c8490f23f1e
  • SHA512 b88441a067c1bc4447191ab9bbd69562ce351f2993e047b46e85d3e004e43cd80fe9c38ad03d8709a54cfd81297e82759dfd104bab6689dd876a61e84b4591d1
  • SSDEEP 49152:hyCml+yllnBHxW2FElxpcYPLyj2czg+tmKTbG6oqZpAr26Ilvco7wl8l1ki1qWmZ:hyCml+yllnBHY2FElxpcYPGj2c8+gKT
  • TLSH
    T1A7E5B51FCA209E69309D1ACC1C59C7EC86DEF65CC0C68AEFA953DB21DB141A98C743E5
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  1^/10
  behavioral1behavioral2
• • Target
    New Order YS2610L108.js
  • Size 2.9MB
  • SHA256 e240c9e03ef15e7a810f33c3315ed0d6713acbbde19bbab6928e3c63e791a94d
  • MD5 98cea3918a01f6963111451fc80fd015
  • SHA1 89eb6f94d9a3f0f7a4b044f211113838e2763b6c
  • SHA512 7b096fcdaf7099d6a6265b24249b1fbc0ca1c513e5e164bc15bae5016e6c6bea6937644856d6a54e3cd083e72a6eba9dc3edb53ff8899b5675fd32648bfb5c00
  • SSDEEP 49152:JyCml+yllnBHxW2FElxpcYPLyj2czg+tmKTbG6oqZpAr26Ilvco7wl8l1ki1qWmT:JyCml+yllnBHY2FElxpcYPGj2c8+gKT0
  • TLSH
    T1BDE5B51FCA209E69309D1ACC1C59C7EC86DEF65CC0C68AEFA953DB21DB141A98C743E5
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  discoveryexecutiondonutloadermassloggerloaderspywarestealerpersistenceransomware

  • Detects DonutLoader

    loader

  • Family: DonutLoader

    DonutLoader is a position-independent code that enables in-memory execution of VBScript, JScript, EXE, DLL files and dotNET assemblies.

    loaderdonutloader

  • Family: MassLogger

    Masslogger is a .NET stealer targeting passwords from browsers, email and cryptocurrency clients.

    stealerspywaremasslogger

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

    discovery
  behavioral3behavioral4