Extracted

• • Target
    GFM-PO-2026-21379.pdf.lnk
  • Size 820B
  • SHA256 26dac40e53f29c682d8f12441ae444b3672ab892eed777f2af136b03c8d83348
  • MD5 c5e25518d21828fef7aa859b87ace06b
  • SHA1 70b1ce4e9bada4a97edfc692f1f6c0b9da14ef43
  • SHA512 6d7f72e0b00bc032e73a7cebc077fd43edc39445bc7e19aedc9f72ccdd68b41e7be1891a63929e8258da59dd7b2228a72502b05fae2d82e748a690ee5dafaa20
  • TLSH
    T1F901150526F74E22F7B2D63028375750093AFD971F03AA0E06D153040811648EAF4FF3
  • MD5 SHA1 SHA512 TLSH

  Score

  3^/10
  behavioral1behavioral2
• • Target
    Updates/GFM-PO-2026-21379.js
  • Size 81KB
  • SHA256 19347dcc84a97457827768b7b0fc0cd8ff1a1997c8b62b21a7f899ee2d72ac38
  • MD5 6058e31ca94a480883988029c41834f4
  • SHA1 e613a718e5fb99fcf6e6ec1b9372c8a9e6deb3c7
  • SHA512 5ddc710e91e682f4b492d1c4743c862952df8b2c70de77842e7c3fcedf73931623f695c9067ce5478d29dbc2d6ddc77ab3b6a283dd04cdfcc77ac25fb39388d4
  • SSDEEP 384:ol98fyDjUCZxX850AsFBWaxLUA5bTfaXEg1n+NXo4XnHBXfXNip1MO83RwQ98i5g:m98fyD7XEoHE1eF3yWFeX3ACWDO2F+
  • TLSH
    T178831ED0E106E584B56F2BDBC5C134C9D18339ED360FCE4A4534B57A22B95AC2FA889F
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  collectiondiscoveryexecutionxorium_stealerpersistenceprivilege_escalationspywarestealer

  • Detects XoriumStealer payload

  • Family: XoriumStealer

    XoriumStealer is an information stealer written in C#.

    stealerxorium_stealer

  • Process spawned unexpected child process

    This typically indicates the parent process was compromised via an exploit or macro.

  • Badlisted process makes network request

    Network request originating from process or tool commonly abused by malware.

  • Command and Scripting Interpreter: PowerShell

    Using powershell.exe command.

    execution

  • Command and Scripting Interpreter: PowerShell

    Run Powershell and hide display window.

    execution

  • Downloads MZ/PE file

  • Drops startup file

  • Executes dropped EXE

  • Reads WinSCP keys stored on the system

    Tries to access WinSCP stored sessions.

    spywarestealer

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Accesses Microsoft Outlook profiles

    collection

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery

  • Contacts third-party web service commonly abused for C2

    Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  behavioral3behavioral4