Extracted

• • Target
    SPARE PARTS SPECIFICATION LIST.JS
  • Size 2.7MB
  • SHA256 22313336bb0074479060b20651d0991d87226fd69c992d57298c1841d9f251f7
  • MD5 73c7304da1d316f7b8b09c0e9227a825
  • SHA1 a30d0568d04108b3f25178bd466a56db3b07ab3e
  • SHA512 e9905e1aa9e35097947ce2b43518f1c887ada72e862851b2ea130f47b03cb5eabb14bdba3f55d985adc654a4ec13225918130620f0c91aab2d82e0e86e7fb5b2
  • SSDEEP 49152:sKa3HTuTvxDSJTjHDBR5jCXGjtyQD66BS6FGvI989ag1AL+d8uGRYqelH/Gwn:6jHDBR5jCXGjtyQD66BS6QvI98YgOqGE
  • TLSH
    T1B5D5B645AB986533212ED32CF1759FAC4D0F106320B9DF0C306ED624B96DE17AB59AE3
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  collectionexecutiondonutloaderxwormloaderpersistenceratspywarestealertrojan

  • Detect Xworm Payload

  • Detects DonutLoader

    loader

  • Family: DonutLoader

    DonutLoader is a position-independent code that enables in-memory execution of VBScript, JScript, EXE, DLL files and dotNET assemblies.

    loaderdonutloader

  • Family: Xworm

    Xworm is a remote access trojan written in C#.

    trojanratxworm

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Reads user/profile data of local email clients

    Email clients store some user data on disk where infostealers will often target it.

    spywarestealer

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Accesses Microsoft Outlook profiles

    collection
  behavioral1behavioral2