Extracted

• • Target
    APX NEW PR XX03974 RFQ.JS
  • Size 2.3MB
  • SHA256 b93c000843d3540069fbcccf74a536084cdda84a6aa4fbbe54e6e499ec34b230
  • MD5 bb31e3671c6f3e10d7782b3538ba5fd0
  • SHA1 5115bd2594e5bfef125a73d7f64e53e45c4c488e
  • SHA512 d824cf8cd0bcbfa81d4e681f1a8392ad99e1c1454e70dd0a9705138d0771d7f2da9bb1dea909ef1bfb53adb4828c841eba4569282fb92b67f7c58c68862c66d2
  • SSDEEP 49152:AhFQhXE5nKDygEHjDFocjg4+XUwXCjO934z3uFVMoxDvHe:AhFQhXE5nMygEHjDFoRdCS9obXwHe
  • TLSH
    T18FB529608628A5717A7ED33CD03A5F68084DA0072069EF1E35BD4764B5AAF17639CBF3
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  collectionexecutiondonutloaderxwormloaderratspywarestealertrojan

  • Detect Xworm Payload

  • Detects DonutLoader

    loader

  • Family: DonutLoader

    DonutLoader is a position-independent code that enables in-memory execution of VBScript, JScript, EXE, DLL files and dotNET assemblies.

    loaderdonutloader

  • Family: Xworm

    Xworm is a remote access trojan written in C#.

    trojanratxworm

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Reads user/profile data of local email clients

    Email clients store some user data on disk where infostealers will often target it.

    spywarestealer

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Accesses Microsoft Outlook profiles

    collection
  behavioral1behavioral2