Extracted

• • Target
    SHIPPING DOCUMENT.JS.js
  • Size 3.2MB
  • SHA256 46a053629a06d8578d58e3edf33fa01e8d6ab4813588156ac0e9a8d3c4553082
  • MD5 e092ec098f18fed2a6f2828d3f2eb566
  • SHA1 b623a8ba7c5cd289ce73f3554a5a61ea8a890e6d
  • SHA512 20542e8176042891a8e569c9c94c5c6ec716f57df8cd1b7b65ff284f34a9b4f55a15875de4902f816fff913635c56126f1f7ffa20a769cff94ac0615ceb7585c
  • SSDEEP 98304:CVFqnLH+xjtYL2aC2274kapGDufIPGAjiKImIBuXTCI:yhJYKXP73wGDuftxNmnx
  • TLSH
    T101F533C2AE29706573BD53BDCCB76710CC05128F8664BBAE307E5144BBBB5824B68DE1
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  collectiondiscoveryexecutiondonutloaderxwormloaderratspywarestealertrojan

  • Detect Xworm Payload

  • Detects DonutLoader

    loader

  • Family: DonutLoader

    DonutLoader is a position-independent code that enables in-memory execution of VBScript, JScript, EXE, DLL files and dotNET assemblies.

    loaderdonutloader

  • Family: Xworm

    Xworm is a remote access trojan written in C#.

    trojanratxworm

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Reads user/profile data of local email clients

    Email clients store some user data on disk where infostealers will often target it.

    spywarestealer

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Accesses Microsoft Outlook profiles

    collection
  behavioral1behavioral2