Extracted

• • Target
    DDoS bot net xM3L8.bat
  • Size 366KB
  • SHA256 7d147dc5f1df92fb23d871b4166bda38da143d71ddb5295698ce0d2647accf3f
  • MD5 3c101f079d0cd142af49c8a4dfc0595c
  • SHA1 425bb63a1e6a085a38dc20b48af756c345529b1f
  • SHA512 69f96cbd5640c87f377676448973272e187993f8589b657aa2246d2fd898377d6752a07401f732c700f40e6a4bee477bb1e0fbace5fd4e9a426ff88108ef5dbd
  • SSDEEP 6144:6rAKca10JUVflqF1xX32K7d2NeBkq+FyIRgZGU+p0r1SxEh+iC8dnjgoV7PuvVKC:6czyAwK1xX32Igekq6NCv+pg1SEh+SdM
  • TLSH
    T1F084EF9A2348A3E576F14269C72EE3BEF74E1551149AF3E48E6944EF31D93B80A31C43
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  executiondonutloaderxwormloaderrattrojandefense_evasion

  • Detect Xworm Payload

  • Detects DonutLoader

    loader

  • DonutLoader

    DonutLoader is a position-independent code that enables in-memory execution of VBScript, JScript, EXE, DLL files and dotNET assemblies.

    loaderdonutloader

  • Donutloader family

    donutloader

  • Xworm

    Xworm is a remote access trojan written in C#.

    trojanratxworm

  • Xworm family

    xworm

  • Badlisted process makes network request

    Network request originating from process or tool commonly abused by malware.

  • Command and Scripting Interpreter: PowerShell

    Run Powershell and hide display window.

    execution

  • Indicator Removal: Clear Windows Event Logs

    Clear Windows Event Logs to hide the activity of an intrusion.

    defense_evasion
  behavioral1behavioral2