Extracted

• • Target
    REVISED_WORK_ORDER_FOR_MATERIAL_DELIVERY_OF_4500417389_S27BOZGMDTOZGMD.JS.js
  • Size 3.9MB
  • SHA256 72b09b6d78134a4f3ceafe8736bbe82b32aae217df23dab4568849c786005479
  • MD5 c0d1c0db73a6fb6c3e6ae0cbbb9a2293
  • SHA1 0b0f75dc70f69f4e048fb7dccdd3b92b52d88325
  • SHA512 9a684e5b319253ff4bdd9cd54807abeeff1beb61dd289b788e9d0c562f1781c4d431147d8d48fba75ae44b967f0de0fd3bb596d823946f0e2969be89527948aa
  • SSDEEP 98304:tUiLCikOrRpsUR9+/HM/St0lQGTU/t95+uK8aBXhTRx5Dw+1E59JcFrUMos0fw5G:mGPJRqUz2DGm/t95hK7BXhTRx5Dw+1El
  • TLSH
    T12516F642530395F2772ABB5CD536D971B90A20036BC5DF3A313CA61BBB59D0B631CAE2
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  collectiondiscoveryexecutionagenttesladonutloaderkeyloggerloaderspywarestealertrojan

  • Detects DonutLoader

    loader

  • Family: AgentTesla

    Agent Tesla is a remote access tool (RAT) written in visual basic.

    keyloggertrojanstealerspywareagenttesla

  • Family: DonutLoader

    DonutLoader is a position-independent code that enables in-memory execution of VBScript, JScript, EXE, DLL files and dotNET assemblies.

    loaderdonutloader

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Reads user/profile data of local email clients

    Email clients store some user data on disk where infostealers will often target it.

    spywarestealer

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Accesses Microsoft Outlook profiles

    collection

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

    discovery
  behavioral1behavioral2