Extracted

• • Target
    MAT-150-526-AN PDF.JS
  • Size 2.5MB
  • SHA256 c98a6b45da273b79196f95bf474db6b7c17360c6d0b1866cfd379575a8524f45
  • MD5 71abf1638b5f03c8fd1a0a467df04491
  • SHA1 5c321f3e469d87c877f85b61a29a96741f654eb7
  • SHA512 5bcdd75f201ea45a82f07459a2b5ff19b7e4a14c9e309b2e68b61084663bc73b9f76a1260f810243a14c89071bc52c86cf1dbe53e6139e9a66b6042ab0cb52aa
  • SSDEEP 49152:IaxFiWEgLf8ghmxS2iIYPNBqQLICjMsUVYRbxM3vx2/rRti3ZYGWV7l6I/OFq9r4:zFiWEgLf8xS2iIYPNBBICYseYRbxM3p7
  • TLSH
    T154C54F553F00D032763DD72CD13A8E60E5192A6366CBDF4E327CAA0C7BA5907275DAE2
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  collectionexecutiondonutloaderxwormloaderratspywarestealertrojan

  • Detect Xworm Payload

  • Detects DonutLoader

    loader

  • Family: DonutLoader

    DonutLoader is a position-independent code that enables in-memory execution of VBScript, JScript, EXE, DLL files and dotNET assemblies.

    loaderdonutloader

  • Family: Xworm

    Xworm is a remote access trojan written in C#.

    trojanratxworm

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Reads user/profile data of local email clients

    Email clients store some user data on disk where infostealers will often target it.

    spywarestealer

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Accesses Microsoft Outlook profiles

    collection
  behavioral1behavioral2