Extracted

• • Target
    SH 453655883645 746736647 DOC 54652 PDF.JS
  • Size 2.9MB
  • SHA256 3b417f36741b74e85cd64874ae2475b25e2b7bce2cc2ab80f4e190c2ef8d5881
  • MD5 1a1cfb8bedb0b599e470af411f13a44f
  • SHA1 09aa0a225b81f435c6d9e4196c37176612cb1d36
  • SHA512 2958cd05cef90a3194a2d3443fb2f7e59ea23adedf47307d4af3fd0fc22b72c0f9377ffbfc9124a07adf8cb6f85efa50134c2196788bd177b16cf96e98a17522
  • SSDEEP 49152:OP50UpXqodSacnTMMiT8vwBNI38/MeFHPMkVojKzESEULVP9rCcp75QsAxbwHFjE:s0UpXqodSacnTMMiwvwBNI38/MeFHPMB
  • TLSH
    T112D592849B40E2337AAC671CFA366530A58D139706C5DB2E303CC249777BA9763BC9D9
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  collectionexecutiondonutloaderxwormloaderratspywarestealertrojan

  • Detect Xworm Payload

  • Detects DonutLoader

    loader

  • Family: DonutLoader

    DonutLoader is a position-independent code that enables in-memory execution of VBScript, JScript, EXE, DLL files and dotNET assemblies.

    loaderdonutloader

  • Family: Xworm

    Xworm is a remote access trojan written in C#.

    trojanratxworm

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Reads user/profile data of local email clients

    Email clients store some user data on disk where infostealers will often target it.

    spywarestealer

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Accesses Microsoft Outlook profiles

    collection
  behavioral1behavioral2