Extracted

• • Target
    6ef90729281da2327a73fbe2cd2cfdfa.exe
  • Size 94KB
  • SHA256 e36eee6a572b2c5e45cfaffae49ee361f55915375a4b7c938983fe8f8b5aa539
  • MD5 6ef90729281da2327a73fbe2cd2cfdfa
  • SHA1 2a56d904c4407a01ce4aa65e2fe8b1fd641fc027
  • SHA512 b951f12296b7499fc814ccb0be167d82f2725807f9716fa85b83ec43cb220a502618a9b6849b1159c71c91f50c035cb50e235ec4a6815cb5cc1deb55764301d7
  • SSDEEP 1536:shhQNWouE4Z5OHuJuDSecqRIuY7c7h57NzDHZFrSz+xT0eYQBvslcREVSTUMW1jo:shhQNWoX4Z5OHuOSelIq5PHZFrbxozap
  • MD5 SHA1 SHA512 SSDEEP

  Score

  10^/10

  adwaredonutloaderxwormloaderpersistenceratspywaretrojanransomware

  • Detect Xworm Payload

  • Detects DonutLoader

    loader

  • DonutLoader

    DonutLoader is a position-independent code that enables in-memory execution of VBScript, JScript, EXE, DLL files and dotNET assemblies.

    loaderdonutloader

  • Donutloader family

    donutloader

  • Xworm

    Xworm is a remote access trojan written in C#.

    trojanratxworm

  • Xworm family

    xworm

  • Boot or Logon Autostart Execution: Active Setup

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

    persistence

  • Adds Run key to start application

    persistence

  • Enumerates connected drives

    Attempts to read the root path of hard drives other than the default C: drive.

  behavioral1behavioral2