Extracted

• • Target
    BOQ PPR, UPVC, HDPE & PEX Pipes.MSI
  • Size 320KB
  • SHA256 85e3b894efb0b7c7d3cb144ba958e0dcd5266e9d0092a5b655f2383dab51048e
  • MD5 2dfb9c53a7df4c141e7191fb328c76a9
  • SHA1 2a3997f0e41fa50a9ee640390c621bac5a6c349d
  • SHA512 0938685bf2c96df2746116ad0299e7b89f6eada3fe14f758bda2efabfb95b8fa1b43829af5fd56dd1690a92b641194a1a9ef72909084cf79077aed623aa188a5
  • SSDEEP 6144:lhY+ILlEdHBjvL9BF6WweaniXsh8bibd/m7N2QFdZ1g4hQvHK6QMpzHWb:lhYHiLL6Xnii8bibopr3Z2VvHNHQ
  • TLSH
    T15F64128876F8A537CC0243B28A1B6397D7735DA62B610FC96189F2294F3BCC0468BDC5
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  collectiondiscoveryexecutiondonutloaderxwormloaderransomwareratspywarestealertrojan

  • Detect Xworm Payload

  • Detects DonutLoader

    loader

  • Family: DonutLoader

    DonutLoader is a position-independent code that enables in-memory execution of VBScript, JScript, EXE, DLL files and dotNET assemblies.

    loaderdonutloader

  • Family: Xworm

    Xworm is a remote access trojan written in C#.

    trojanratxworm

  • Executes dropped EXE

  • Reads user/profile data of local email clients

    Email clients store some user data on disk where infostealers will often target it.

    spywarestealer

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Accesses Microsoft Outlook profiles

    collection

  • Enumerates connected drives

    Attempts to read the root path of hard drives other than the default C: drive.

  behavioral1behavioral2
• • Target
    SPECIFICATIONS, PPR, UPVC, HDPE & PEX Pipes.JS
  • Size 2.6MB
  • SHA256 643e87dc048f80594c47b52b8bcabc348f7fcaef4253aa477658f08942f71c24
  • MD5 ffb63c51a545c7e86c0063767ce9730f
  • SHA1 8f0525c3c7e2d8b20fa53f692dc41c7ed48f4387
  • SHA512 66976c73990aea62a7dbb2db805cf81f37770f0bf11f5f6b7a978099e3945f68d819ca679178ff123c12452562ac3b46865907107c6b1595af880173db4eb971
  • SSDEEP 49152:qG548rqBQ7TjDXoa5y7W6OkNF3rZFdJVUlsLUsuI37Q5ZmTPE8EI9uWZ1aKdln:F48OQ7TjDXoyYW6OmprZFdLskuI3woTz
  • TLSH
    T150C5A380030F9533F57E5B3CC43299644646A12F2686EF7E397C525B7BA2A1F134C9EA
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  collectiondefense_evasiondiscoveryexecutionxwormratspywarestealertrojan

  • Detect Xworm Payload

  • Family: Xworm

    Xworm is a remote access trojan written in C#.

    trojanratxworm

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Reads user/profile data of local email clients

    Email clients store some user data on disk where infostealers will often target it.

    spywarestealer

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Accesses Microsoft Outlook profiles

    collection

  • Suspicious use of NtSetInformationThreadHideFromDebugger

    defense_evasion
  behavioral3behavioral4