Extracted

• • Target
    CREATIVE EAX.exe
  • Size 9.7MB
  • SHA256 772d8cfb62cc8c45f449a459742346ef66c5093dda7abba38252f40b0e58531a
  • MD5 c67cd3edfd37061bee66a6bb37ac78e8
  • SHA1 11533588d2699556c2087bfb35d0aee0a05e5fb8
  • SHA512 7ac5ae4a01015b8553f2628b9ef14c15fa51acfee01b2ba5da1b818cf8ea09f2ba3909d2ce50e3400bdb22a3749964da10653427262f5b4009fbe3c1eaa4f54e
  • SSDEEP 768:o75aBeVQHKZUbutoi7MdGvwBa1PetdDCRgHG0xa3Y1+LMpBkjWNACmi58u/4p6r6:nDbUGdm9
  • TLSH
    T1DCA68D0655EE260F68F76FB2DFE4B9FAC287F1E4586938FE049022864711D64DA33076
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defense_evasiondiscoveryexecutiondonutloaderxbinderloaderpersistence

  • Detects DonutLoader

    loader

  • Family: DonutLoader

    DonutLoader is a position-independent code that enables in-memory execution of VBScript, JScript, EXE, DLL files and dotNET assemblies.

    loaderdonutloader

  • Family: XBinder

    XBinder is a crypter and loader delivering a wide variety of malware, written in C#.

    loaderxbinder

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Creates new service(s)

    persistenceexecution

  • Executes dropped EXE

  • Stops running service(s)

    defense_evasionexecution

  • Drops file in System32 directory

  behavioral1behavioral10behavioral11behavioral12behavioral13behavioral14behavioral15behavioral16behavioral17behavioral18behavioral19behavioral2behavioral20behavioral3behavioral4behavioral5behavioral6behavioral7behavioral8behavioral9