Extracted

• • Target
    Sewi.-cleaned.exe
  • Size 2.1MB
  • SHA256 da5b5fd0d39a418c3c3827bfaf3fc639d4f1998eb81cc573a700770e957e1842
  • MD5 8416003064c9c8e95950b29676178e8c
  • SHA1 23dce3392103f3599ab29accda1fca4295c3a212
  • SHA512 ce8376b1124c45bc8413a5c12ea7e489501e46e17bd511cfea4389d856c1d12ebb76cc868d1ac9b0e6cf956f5eea1f6c7663c63019f6005216de96e9dc8ff91d
  • SSDEEP 49152:Um0i06M0sXfailWljibB+vvUps5BG1RKMgZwHMmCcehp:U8ld/ilWljq+kpszRZwsmCB
  • TLSH
    T182A533156760C381EFA441F93677F255E33E60BCA32BE1EC184BF26FB5A47880A15672
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defense_evasiondiscoverydonutloaderxwormloaderpersistencerattrojan

  • Detect Xworm Payload

  • Detects DonutLoader

    loader

  • Family: DonutLoader

    DonutLoader is a position-independent code that enables in-memory execution of VBScript, JScript, EXE, DLL files and dotNET assemblies.

    loaderdonutloader

  • Family: Xworm

    Xworm is a remote access trojan written in C#.

    trojanratxworm

  • Modifies visibility of hidden/system files in Explorer

    defense_evasion

  • Sets service image path in registry

    This determines the executable launched when a service starts. It can be used to establish persistence.

    persistence

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Drops startup file

  • Executes dropped EXE

  behavioral1behavioral2