Extracted

• • Target
    FGH09876546789.bat
  • Size 92KB
  • SHA256 2fd18d94e14f0d6f387f32eee284d5896fe345f690b32cd754f0439d4f16aaed
  • MD5 d8a4b013007f5ac346013406ddd8f783
  • SHA1 cb90a9742b0c3616fe525b094f772c50a50abd2e
  • SHA512 f64894d0638ec5064834dabf3c2a277b95155feb80b2ea5c22325f2ca272b9808a3508b5a941bf079bdda66166e6116b7a1271839776ace8fad268df02ae6436
  • SSDEEP 1536:efsZRPZRxW9n7H1uxeTOVlY+XaOq4wkSceGOLFe7aJqBtAWZ70i2BT4KB+GY6/T+:efs/PtcH1WeTOJqTXcOkN337v2l4Mhhy
  • TLSH
    T1F693F1515D8CAF74DBB5990C81EF28C19BEC1F0B10526A8BAB33DE866F7B24851D31E4
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defense_evasionexecutiondonutloaderxwormloaderpersistencepyinstallerratspywarestealertrojanupx

  • Detect Xworm Payload

  • Detects DonutLoader

    loader

  • DonutLoader

    DonutLoader is a position-independent code that enables in-memory execution of VBScript, JScript, EXE, DLL files and dotNET assemblies.

    loaderdonutloader

  • Donutloader family

    donutloader

  • Xworm

    Xworm is a remote access trojan written in C#.

    trojanratxworm

  • Xworm family

    xworm

  • Command and Scripting Interpreter: PowerShell

    Using powershell.exe command.

    execution

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Adds Run key to start application

    persistence

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  behavioral1behavioral2