Extracted

• • Target
    Remittance Advice 1588434009.JS
  • Size 3.2MB
  • SHA256 80d202865c9e494ecb6eeaa0c28ff6785525ea62f7c0c7ee202b0d5f2d70677f
  • MD5 91cf11d4418b78dbd52c2c7c1b03554b
  • SHA1 104f5e0930a0159eea2c7a000f058083a8d75ad2
  • SHA512 825cf74e088821a8c20a7c9141fab4ecda987fc96da8e42a8571b64cd07d134734cd2a1a0c0051d78c1a3b757dffda3ab3ed726e9964e8d06b20f839d616b97c
  • SSDEEP 98304:46SkHn0Y1SvIyyzYvMhjfaudcVlshGLUaPqOay/qVb:46FHPvyysM1faLLUCu
  • TLSH
    T11DF50BC8A7C4D1317A2B939EF326A52295061B83D2C1AF09306C91347B77B8A536FDF5
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  collectionexecutiondonutloaderxwormloaderratspywarestealertrojan

  • Detect Xworm Payload

  • Detects DonutLoader

    loader

  • Family: DonutLoader

    DonutLoader is a position-independent code that enables in-memory execution of VBScript, JScript, EXE, DLL files and dotNET assemblies.

    loaderdonutloader

  • Family: Xworm

    Xworm is a remote access trojan written in C#.

    trojanratxworm

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Reads user/profile data of local email clients

    Email clients store some user data on disk where infostealers will often target it.

    spywarestealer

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Accesses Microsoft Outlook profiles

    collection
  behavioral1behavioral2