Extracted

• • Target
    aaa.bat
  • Size 123KB
  • SHA256 45640e60e357c0b6dede2e7535c8fe0bb1f12386bc53ac49d1852afda40ea614
  • MD5 ca9ab5a182b3b408b92ab285e01953ee
  • SHA1 5bf12ac8444c41f6ee78e43cea0376afbc707519
  • SHA512 d8b7db1bf12bcd79c3fdd7c83207647834b2d74c69d741a2a4310fea4d5606083b875aaeda1052431bced014cd15986ea5d70a27ae95402b459f018c4bc4dc9f
  • SSDEEP 3072:ONFiJ23Mx87AlTuqiKyfRJdMwbm6WgoTZoWXiedE:88g3A4qgnSwb3oT/yedE
  • TLSH
    T16CC3E1238DC8AE74CBF8652D80BF5A5E23F4469F2561B98EF7777D4AEFAA5100153080
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defense_evasionexecutiondonutloaderxwormloaderpersistencerattrojan

  • Detect Xworm Payload

  • Detects DonutLoader

    loader

  • DonutLoader

    DonutLoader is a position-independent code that enables in-memory execution of VBScript, JScript, EXE, DLL files and dotNET assemblies.

    loaderdonutloader

  • Donutloader family

    donutloader

  • Xworm

    Xworm is a remote access trojan written in C#.

    trojanratxworm

  • Xworm family

    xworm

  • Command and Scripting Interpreter: PowerShell

    Run Powershell and hide display window.

    execution

  • Registers new Windows logon scripts automatically executed at logon.

    persistence

  • Adds Run key to start application

    persistence
  behavioral1behavioral2