Extracted

• • Target
    2026-04-15_972ed7d83dfe854d04d486fe7f96c2c3_cobalt-strike_icedid_satacom
  • Size 197KB
  • SHA256 655fe6ccb17c698f1d5b12914a37e00b4108a8c05e5dc17323a4cd03217a46a3
  • MD5 972ed7d83dfe854d04d486fe7f96c2c3
  • SHA1 52f36c3e75b6b3db70c944337caea5f9ab167211
  • SHA512 b55ea3b9ce3cf7035998d1e0e18cdc7b5e07c9d6c6d27d73b7d48df6fa7e72abc708d6fed256e8510e1f3939330b87c5eb70d57c511dbf9438f3771fd9ac21b8
  • SSDEEP 3072:9D/LBVckQT6OVEbAbZgtCgAsevtRmOCiWZrIzI8scauOcxoOtrdb7VaTp2N:9DVVcVVEEb9vSDvZcU/uzxzbg1A
  • TLSH
    T10414CF57A3A534F8E177963A84511A09E762787617208FFF0371468A1FE72E18C3AFB1
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  donutloaderxwormloaderpersistenceransomwarerattrojanexecution

  • Detect Xworm Payload

  • Detects DonutLoader

    loader

  • Family: DonutLoader

    DonutLoader is a position-independent code that enables in-memory execution of VBScript, JScript, EXE, DLL files and dotNET assemblies.

    loaderdonutloader

  • Family: Xworm

    Xworm is a remote access trojan written in C#.

    trojanratxworm
  • Custom signature

    Detects Windows executables referencing non-Windows User-Agents

  • Boot or Logon Autostart Execution: Active Setup

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

    persistence

  • Command and Scripting Interpreter: PowerShell

    Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

    execution

  • Drops startup file

  • Enumerates connected drives

    Attempts to read the root path of hard drives other than the default C: drive.

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  behavioral1behavioral2