Extracted

• • Target
    orden de compra (OC).JS
  • Size 3.3MB
  • SHA256 7dbcab2b8bdfe6d83cfeb8de792f58b2519d652209bbf5cbfa447a5f2258735c
  • MD5 b3cd2d9319e3434c18dd320e577e528e
  • SHA1 2779d5fab6151c8c4f2657d3b54c8263530a8bd8
  • SHA512 f7ffeb79a4c9efda9420fe683037c71c748aaf179a7b0685c4b9775c97f4b79c4741c31978806563480278e2e8bed91db4af631255c9c5988117495a1d03e134
  • SSDEEP 98304:7mdfI/14mMGFafP636ycu91wo0xrAI7R0s7gubSItjA7q87gfnbizEswOV758O1a:Ug1mUiPekuP30xE+Gs7gllgje0
  • TLSH
    T137F5E5411F4FB17276226B4C4636CD3C990A60D329DADF3E30A9B214F668D07A75CBE6
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  collectiondiscoveryexecutionagenttesladonutloaderkeyloggerloaderpersistencespywarestealertrojan

  • Detects DonutLoader

    loader

  • Family: AgentTesla

    Agent Tesla is a remote access tool (RAT) written in visual basic.

    keyloggertrojanstealerspywareagenttesla

  • Family: DonutLoader

    DonutLoader is a position-independent code that enables in-memory execution of VBScript, JScript, EXE, DLL files and dotNET assemblies.

    loaderdonutloader

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Reads user/profile data of local email clients

    Email clients store some user data on disk where infostealers will often target it.

    spywarestealer

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Accesses Microsoft Outlook profiles

    collection

  • Adds Run key to start application

    persistence

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

    discovery
  behavioral1behavioral2