Extracted

• • Target
    perfect.ps1
  • Size 71KB
  • SHA256 4f3ac17ca2c10d5129d7001d855b7ac073abccde991424cb2962a48ed3e8bb0b
  • MD5 202a45a94c6484ea89330c2075842933
  • SHA1 f9a9f87ae46e1df10176caaa5e75a452f3226036
  • SHA512 bb153f57a6f3e60adb95d961fa6081aec9408222a6863ad63b4bb8a3265f149d4abb7d99bb9a4d0ed7245ed472d54f96aae6c715216365a8991706009a2e6b96
  • SSDEEP 1536:JPr6XkoDSgpUaenoda9rbgB8dRt3JWAylhX+mlf9nG:dYkoJpUaeo49PgCrBYlxHlf9nG
  • TLSH
    T10563F1404F8187EC3F4BDFFAB0A7E2CDC597A127904B9D2837A06E456B07A44972E94D
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  executiondonutloaderxwormloaderrattrojan

  • Detect Xworm Payload

  • Detects DonutLoader

    loader

  • Family: DonutLoader

    DonutLoader is a position-independent code that enables in-memory execution of VBScript, JScript, EXE, DLL files and dotNET assemblies.

    loaderdonutloader

  • Family: Xworm

    Xworm is a remote access trojan written in C#.

    trojanratxworm
  behavioral1behavioral2