Extracted

• • Target
    ORDER LIST AND SAMPLES_0786864GN.JS
  • Size 2.7MB
  • SHA256 1dfdef98368073a0883eabefd1a26ba4e3fb0fb2b6c27f6963082c189c61e149
  • MD5 4e99bd5f4bbd439805f8e0a280c373fb
  • SHA1 9b3c3b7d843e79142e2913637a362512773941d7
  • SHA512 6df16740a15cb0934413f3cf9975d19f59e08fd629bfe90070b8b1d6248b2920f0b407cdb97538f9289f3223195a74462cac7f55326fec6ed3062d7223caa950
  • SSDEEP 49152:dM3z7VTzEkbcpcJSMTnu/pJ5qhXYt1EabSHLb7baZvxh6vMr8q7/QcxedvlHQ:O3z7VTzEkbcpcJSMTnu/pJ5qhXw1EISC
  • TLSH
    T177D54B8C6372D13277216B5C57F79921890A6C3334CBDB35332CDE1A3A6994F6318AE6
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  collectiondefense_evasiondiscoveryexecutiondonutloaderxwormloaderpersistenceratspywarestealertrojan

  • Detect Xworm Payload

  • Detects DonutLoader

    loader

  • Family: DonutLoader

    DonutLoader is a position-independent code that enables in-memory execution of VBScript, JScript, EXE, DLL files and dotNET assemblies.

    loaderdonutloader

  • Family: Xworm

    Xworm is a remote access trojan written in C#.

    trojanratxworm

  • Command and Scripting Interpreter: PowerShell

    Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

    execution

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Reads user/profile data of local email clients

    Email clients store some user data on disk where infostealers will often target it.

    spywarestealer

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Accesses Microsoft Outlook profiles

    collection

  • Adds Run key to start application

    persistence

  • Executes a VBScript file via the Windows Script Host.

    execution
  behavioral1behavioral2