Extracted

Extracted

• • Target
    payment advice.JS.js
  • Size 3.4MB
  • SHA256 c8d85a9c188977e5297055c2aefa1dc460d879b6f945c2fbb1d976531f3e6b0b
  • MD5 a2d5bef446db691ee9e73646cb3d06aa
  • SHA1 3b7c6bf8b7dc0dab67f28bf345ac5ccb250e8588
  • SHA512 0fccd03502cfadacc7dafc4024204e9bcbdcac3691cdd17d76c590347c4b3445f368cb1a936767eff49af4efe04c17ca46437f9181bc09a959abb29ddd131dd9
  • SSDEEP 98304:OLh0jfuR/JLJj24aylu0CYZz8I4LUzwqn7D+W8nzUN/+IMmV3rxXzBSQ5AKk933+:0072LlZ7vzz4Azwq7Db82/+IMmRZMQ5F
  • TLSH
    T1CCF5D545675091F27B32BBBC8636CC3D460A61036BCADF39726CD2987A1CD476718BE2
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  collectiondiscoveryexecutionagenttesladonutloaderkeyloggerloaderpersistencespywarestealertrojan

  • Detects DonutLoader

    loader

  • Family: AgentTesla

    Agent Tesla is a remote access tool (RAT) written in visual basic.

    keyloggertrojanstealerspywareagenttesla

  • Family: DonutLoader

    DonutLoader is a position-independent code that enables in-memory execution of VBScript, JScript, EXE, DLL files and dotNET assemblies.

    loaderdonutloader

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Reads user/profile data of local email clients

    Email clients store some user data on disk where infostealers will often target it.

    spywarestealer

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Accesses Microsoft Outlook profiles

    collection

  • Adds Run key to start application

    persistence

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

    discovery

  • Executes a VBScript file via the Windows Script Host.

    execution
  behavioral1behavioral2