Extracted

• • Target
    _854f438df394fb8bb4052b8f43bf7008d39ae83f0e55f44e126029061dafbab6.txt
  • Size 2.9MB
  • SHA256 854f438df394fb8bb4052b8f43bf7008d39ae83f0e55f44e126029061dafbab6
  • MD5 b6d5495446137f5ef0761961ab9f1c9b
  • SHA1 c8431443017eaf39d07789d9d388f5ba097c17d3
  • SHA512 1465042003c259054b85d030638bdf2992f1c033860857508b1832a5947f9877c568c3e3dc7a4fa90dd277487e92604d2b12e6da8c088123ef6fc7b1b3cca0b8
  • SSDEEP 49152:HLweIeohVGpDK040GpO0T439sB9l1p4SiyUrPWjKTZEj47sYn9Kefk5TkYqPEIrz:HLwAohVGpDSO0T439sB9lsSDUrPWjKTj
  • TLSH
    T1D0E50751CA25A634797CCB2ED037AFB0045E20479538EF2E353A9A18A946F8F139D4F7
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  executiondonutloaderxwormloaderrattrojan

  • Detect Xworm Payload

  • Detects DonutLoader

    loader

  • Family: DonutLoader

    DonutLoader is a position-independent code that enables in-memory execution of VBScript, JScript, EXE, DLL files and dotNET assemblies.

    loaderdonutloader

  • Family: Xworm

    Xworm is a remote access trojan written in C#.

    trojanratxworm

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  behavioral1behavioral2