Extracted

Extracted

• • Target
    Bank Statement pdf document.JS.js
  • Size 3.3MB
  • SHA256 8a14463045791b5eaedbbf5946f3f93ae97bcd4edebc5c98877078a6196aa001
  • MD5 6e6ea3697554b3cb4b7cd2fd9ae61fb3
  • SHA1 42b1639f08c1cdcc53a0515dffe95cbdb5984d5a
  • SHA512 c4f386298314fddd66e5393ec6c78cab51b5ee83b2acdaf0efd504607921328266e2d5e978ffb56b090702de781fd8475c79a5498de80b2aa1968e6ca2bbc563
  • SSDEEP 98304:J4Pn+w7Q1u8zMbmApIJ/BN0HryF/PTNP1QQkBgBFu5KW7Sn5aNMEont6uIf3qTN4:JVw7n8RA8/BNAry1PBC5K4NzUjNGFQuP
  • TLSH
    T128F56C485288F792E4BC1D10BE0DEAEF4B15A547EE61E9337724B5AAA748FC33708714
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  collectiondiscoveryexecutionagenttesladonutloaderkeyloggerloaderspywarestealertrojan

  • Detects DonutLoader

    loader

  • Family: AgentTesla

    Agent Tesla is a remote access tool (RAT) written in visual basic.

    keyloggertrojanstealerspywareagenttesla

  • Family: DonutLoader

    DonutLoader is a position-independent code that enables in-memory execution of VBScript, JScript, EXE, DLL files and dotNET assemblies.

    loaderdonutloader

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Reads user/profile data of local email clients

    Email clients store some user data on disk where infostealers will often target it.

    spywarestealer

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Accesses Microsoft Outlook profiles

    collection

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

    discovery
  behavioral1behavioral2