Extracted

• • Target
    Quotation.JS.js
  • Size 2.4MB
  • SHA256 f6faf9fc35489cec62820f6f3cc353e0af986d67314bdbd5a5abf4fa4c067a3a
  • MD5 21e60fdc4538e63652ae60be7bd3a3f9
  • SHA1 8536952094ecb718f84029f1e533c1102bcb00e9
  • SHA512 a7e694de7b41fa8f41620e0b541e1f212e645c4de9038e38ec69f99ea998a59eb331678aaf98f569744ed59f32a3e45be0a14a45a6df468941c7602f1a15bfcd
  • SSDEEP 49152:92+TlLz9jIio4kglKilH7yx+ux0kZRlqCgv/JcOmObc0sQ7:9lTlLz9jOJglKilH7yx+60kZRlXgv/JL
  • TLSH
    T15DC5A2415700A772F97C732EE0378AA16604A10344D9DF3E347A4225F7E5A27A7BEDE2
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  collectiondefense_evasionexecutiondonutloaderxwormloaderratspywarestealertrojan

  • Detect Xworm Payload

  • Detects DonutLoader

    loader

  • Family: DonutLoader

    DonutLoader is a position-independent code that enables in-memory execution of VBScript, JScript, EXE, DLL files and dotNET assemblies.

    loaderdonutloader

  • Family: Xworm

    Xworm is a remote access trojan written in C#.

    trojanratxworm

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Reads user/profile data of local email clients

    Email clients store some user data on disk where infostealers will often target it.

    spywarestealer

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Accesses Microsoft Outlook profiles

    collection
  behavioral1behavioral2