Extracted

Extracted

• • Target
    2026-06-27_ed8e74e0eb69487ed7a105ac6c05a82b_frostygoop_glassworm_hive_knight_luca-stealer_salatstealer_sliver
  • Size 4.0MB
  • SHA256 bbd9b8056f45e78c75028f31179a89b92e5d75e179ee2fcde1e3d57ee2264538
  • MD5 ed8e74e0eb69487ed7a105ac6c05a82b
  • SHA1 8890ac0a077910c82ae14fac2b36eb3007f43338
  • SHA512 9f9f2665bc075c9d61d00be56b44934a6cd99420ee10016b1aee726a4d07676e4df4a10e19b2ab19cf461efbe78bdd20e4942708b85a9ec98593e817ac06dfc0
  • SSDEEP 49152:Dyw/o0iAtWeTkKQzdM6Xutvp3KwoQuj5IvXBlnX+oEELo:Dr
  • TLSH
    T14616BF06385014E6E07592724AA651A47724BC961F72AFCF3EE07B763FB17E2B931B04
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  adwarediscoveryexecutiondonutloaderxwormloaderpersistenceransomwareratspywaretrojandefense_evasion

  • Detect Xworm Payload

  • Detects DonutLoader

    loader

  • Family: DonutLoader

    DonutLoader is a position-independent code that enables in-memory execution of VBScript, JScript, EXE, DLL files and dotNET assemblies.

    loaderdonutloader

  • Family: Xworm

    Xworm is a remote access trojan written in C#.

    trojanratxworm

  • Badlisted process makes network request

    Network request originating from process or tool commonly abused by malware.

  • Boot or Logon Autostart Execution: Active Setup

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

    persistence

  • Command and Scripting Interpreter: PowerShell

    Run Powershell and hide display window.

    execution

  • Downloads MZ/PE file

  • Executes dropped EXE

  • Adds Run key to start application

    persistence

  • Contacts third-party web service commonly abused for C2

    Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.

  • Enumerates connected drives

    Attempts to read the root path of hard drives other than the default C: drive.

  • Obfuscated Files or Information: Command Obfuscation

    Adversaries may obfuscate content during command execution to impede detection.

    defense_evasion
  behavioral1behavioral2