Extracted

Extracted

• • Target
    PO-9838.JS
  • Size 9.3MB
  • SHA256 c6537c972b67ab952551d39f2112c3d1ff616c0c3da12256539aeae32478eb40
  • MD5 f72b4e3e57712514461c043476241927
  • SHA1 17ac4df5e472c8225c6c8fe91c183a02ec8706e4
  • SHA512 ddeebc4b5498280933939c54786589edc9c59c595bce2558df7e0db78914e9a067e6c7509112a6c46c86f619ca7479717c77d076553a73f7206a2b129ec11488
  • SSDEEP 196608:sNJozxZYQXuGcBaZF4IzFwUha2HrnXGaXvLhsjB4AiFwADGFS+hrP9nxmvj9vA3b:sgDYQeG74IzFY+XGaXvLhsWAgiw+hT9R
  • TLSH
    T16AA62942121AC9B0DA2F6B2CE57BE5B04A5D35D7528BEF3D30B8134477A26076F8D8D2
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  collectiondiscoveryexecutiondonutloaderphantom_stealerloaderpersistencespywarestealer

  • Detects DonutLoader

    loader

  • Family: DonutLoader

    DonutLoader is a position-independent code that enables in-memory execution of VBScript, JScript, EXE, DLL files and dotNET assemblies.

    loaderdonutloader

  • Family: PhantomStealer

    Phantom Stealer is a stealer written in C#, forked from the Stealerium family.

    stealerphantom_stealer

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Accesses Microsoft Outlook profiles

    collection

  • Adds Run key to start application

    persistence

  • Suspicious use of SetThreadContext

  behavioral1behavioral2