Extracted

• • Target
    Purchase Order DOC.JS.js
  • Size 2.0MB
  • SHA256 aff2b20d9f096d44ec7961869cd30f20e6717d102d4b03422b3b895c0e991833
  • MD5 ceb2f1e92eedb4e67739216f59f409fa
  • SHA1 083cc58e18ebffd55435946c546bec902ef0ce55
  • SHA512 1ffdcac6e9976e43953c1e5987bb8e34c3587e9f319e22c2b8531d647e61de7e240014dc066f70967fa5ee0c8048f7ff5b718aad2a9fe7f947561d655e20723f
  • SSDEEP 6144:XhPvZ0PkuTUY26V1f47k0GQLyDkG/IdYJHw5p/JjB10myJzS3JOJT+XjdAf9PopL:XhPKPkVGf4o0WmFhyCj0PNTN8
  • TLSH
    T15F9576DCEB8753CF95E6A2EAD57A660CF117334E83002406FE2CC1759BB122ED4599AC
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  collectiondiscoveryexecutiondonutloaderxwormloaderratspywarestealertrojanpersistenceransomware

  • Detect Xworm Payload

  • Detects DonutLoader

    loader

  • Family: DonutLoader

    DonutLoader is a position-independent code that enables in-memory execution of VBScript, JScript, EXE, DLL files and dotNET assemblies.

    loaderdonutloader

  • Family: Xworm

    Xworm is a remote access trojan written in C#.

    trojanratxworm

  • Badlisted process makes network request

    Network request originating from process or tool commonly abused by malware.

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Reads user/profile data of local email clients

    Email clients store some user data on disk where infostealers will often target it.

    spywarestealer

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Accesses Microsoft Outlook profiles

    collection
  behavioral1behavioral2