Extracted

• • Target
    2026-05-11_ab1892e7171e173f3471b9986f4b0c0e_akira_cobalt-strike_rusty-stealer_satacom
  • Size 265KB
  • SHA256 ce60f4779ed758f46fc30b2d488a23768b378624ef61a0f0bef7bdfd0dd86da6
  • MD5 ab1892e7171e173f3471b9986f4b0c0e
  • SHA1 164e560355ec823cc4317fccd61bbf4b5027470c
  • SHA512 b53c59005bc7d378e27a356940961eac9f6551e3ec533b2f89fc9ce5fe8bfbcb64234c89a07d967e064defe81956d4b5c80064021f32f118429e8aa401141039
  • SSDEEP 6144:xhzqA3KkhBXlQF3yNl8ew0NYFW3UugMueiD1lYdzWW:kkhBXlxH21l4
  • TLSH
    T1EB444A39FD4160ECD812E275D34AD6BAF67235C64F2239FB27C652383E15EA41E38A50
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  donutloaderxwormloaderpersistencerattrojan

  • Detect Xworm Payload

  • Detects DonutLoader

    loader

  • Family: DonutLoader

    DonutLoader is a position-independent code that enables in-memory execution of VBScript, JScript, EXE, DLL files and dotNET assemblies.

    loaderdonutloader

  • Family: Xworm

    Xworm is a remote access trojan written in C#.

    trojanratxworm

  • Detects Windows executables referencing non-Windows User-Agents

  • Executes dropped EXE

  • Adds Run key to start application

    persistence

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Drops file in System32 directory

  behavioral1behavioral2