donutloader | 1c722630ba79029f4ed1b8ac80c6c6b4ce37ea9060bd55b8d5f057c9c4c41e0a

Sharing

Copy URL Twitter E-mail

General

Target
XWorm V6.4.zip
Size 21.1MB
Sample260705-sg1d6ac15v
SHA256 1c722630ba79029f4ed1b8ac80c6c6b4ce37ea9060bd55b8d5f057c9c4c41e0a
MD5 a3a1fa959213e6f95987730f19dbf8ad
SHA1 0aad8a9628e371f06b582e8542a7b2e701466182
SHA512 db040883ed9b91776424f32a1c65c2c37f5c0fb66ef0dab4c9b5e0d398fabaf9ae0ad551e7aca9c5c27307335c4ca6d4dfdea78801808b6deb2eeaa80f52412e
SSDEEP 393216:2jhh7i+DV/GKDkWvtutU8ZkwPSarBxbE/rmB8SBCReBvfkxf7UX9lYlf+0/DpB:2jhhRDBGmkKtj8ZkwPS43MWFBKeVkZUq
TLSH
T1DF2733054D1524E0C5B2CA79013D1AB355BBA7E9DB2CC6CEF93B181ECDCA9E18106EB7
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Targets

- Target
  XWorm V6.4/MySql.Data.dll
- Size 1.1MB
- SHA256 b9974ec9c4b5453b6a00f2235edcfdcaaad931928c35faf8aac0bb57ef69d782
- MD5 94e00465e44f5782938e27df2dc7362e
- SHA1 2970ceef0c1e6cfe3b8714c428c8857c7b157ca7
- SHA512 25cd34b4ff0e2fe9905f836240aeeeb3202c62a9604c46ae4535016cbad43a31389b9ef11b2f6836ec5f458114aca97a1c63edbf9d598a24f35c7ab6be763e20
- SSDEEP 24576:Y/G6E9m5a3wZC7FuuDqUDcEepg7kiOKTt:9qgVLcEepKuK
- TLSH
  T103456C0037F9EA29D6DF9679E77596184BF1E905B102F75F1208E5A92C33B408E40BB7
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral1 behavioral2
- Target
  XWorm V6.4/NAudio.dll
- Size 502KB
- SHA256 81b3f1dc3f1eac9762b8a292751a44b64b87d0d4c3982debfdd2621012186451
- MD5 3b87d1363a45ce9368e9baec32c69466
- SHA1 70a9f4df01d17060ec17df9528fca7026cc42935
- SHA512 1f07d3b041763b4bc31f6bd7b181deb8d34ff66ec666193932ffc460371adbcd4451483a99009b9b0b71f3864ed5c15c6c3b3777fabeb76f9918c726c35eb7d7
- SSDEEP 6144:96/i10SZtfzWctj98vZcE0wmLlaIZs5eku2sX2hrjAzvgmXa6W9FwsT9idwktQZG:9yrSKMJR9aGs55T1X9Fwspi2tGpmS
- TLSH
  T156B45C2237E4962BD1AF5775E4E1191B8BB1F8423237D78F8684BB6E1D837924C407A3
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

6^/10

adware persistence ransomware spyware
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral3 behavioral4
- Target
  XWorm V6.4/Newtonsoft.Json.dll
- Size 695KB
- SHA256 e1e27af7b07eeedf5ce71a9255f0422816a6fc5849a483c6714e1b472044fa9d
- MD5 195ffb7167db3219b217c4fd439eedd6
- SHA1 1e76e6099570ede620b76ed47cf8d03a936d49f8
- SHA512 56eb7f070929b239642dab729537dde2c2287bdb852ad9e80b5358c74b14bc2b2dded910d0e3b6304ea27eb587e5f19db0a92e1cbae6a70fb20b4ef05057e4ac
- SSDEEP 12288:GBja5bBvR8Q0TE2HB0WLmvXbsVG1Gw03RzxNHgKhwFBkjSHXP36RMGy1NqTUO:GBjk38WuBcAbwoA/BkjSHXP36RMG/
- TLSH
  T166E4394123F98F2BE1AF6B75B4704E1543F9F917A6B5E78F9A04D9A91C43B408E403A3
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

6^/10

adware persistence ransomware spyware
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral5 behavioral6
- Target
  XWorm V6.4/Plugins/ActiveWindows.dll
- Size 14KB
- SHA256 22ec63cb694cb33ed5e47d687f45af519cbb935eefe9e105f8a065c34a0bea5d
- MD5 1825a9ece42b3a38bce2bf17f40e05c2
- SHA1 81e3d8abdc3352b7899188c61b4d113f86bf746f
- SHA512 1985d529ffbf283d92b2c1da98b037d066283a13e04c493ff17a866f5d6033d2ec7c3d9f9eedd0c81280b224079747f8177097c24f70781f71bb49774bf7c86c
- SSDEEP 384:MRttr7olU5QrGPbONr3odT8ptsY7XZOEDue:MRtuRrGPbHt0ZOED9
- TLSH
  T112624A69E3E44335C6FE1FB25C73A3001370C6088C47FB5E1ACCA2969D5BA9D8B91766
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral7 behavioral8
- Target
  XWorm V6.4/Plugins/Chat.dll
- Size 18KB
- SHA256 6e4ec58c52fb76e93d64fb030b01b220b0cd9d94923c7a7998fa3ca7a8dbf972
- MD5 228f7c41282d0a69587458d9418644c6
- SHA1 84ea8e998e2b983be895e114c8fadcf8e17868c4
- SHA512 c2f206cf583e9adf35a4ad80de4535afd5f148fa4b30668d969e8816665f4da5995b74fe26cf93f22f628db9f09c31171cb201c1d1cdf327feba97d07c221eee
- SSDEEP 384:BMOna4ifKQtuUvl0BY0iYUsBQcrwTKvh6GIKoIufWmWGfN:+KQtuq2Y0lUUvr0pIufWZ+
- TLSH
  T1E1821929539583B3C6FE2BF65D72E1A043B1D211CA07EF6FADDCB0AA48933528741791
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral10 behavioral9
- Target
  XWorm V6.4/Plugins/Chromium.dll
- Size 32KB
- SHA256 e130b25e25828eb70036d88b2aa5868a47fc6ef7df83ace8ed9b1ca050fc0500
- MD5 5730cf046b935543bc7b871d411edb52
- SHA1 00b9d0621091d89ce7dc8cfed61b25bc8491ff1b
- SHA512 926818bfd0104b8c75e1537ec6f24673bbdd4d2efea33e669805e5b058e9d2b2352288b4ea60aee2034ed1500dc102e4daa3217140509da5f95813dcf14983f8
- SSDEEP 768:7SyQlmUmBlEuPuXfjq2sgDrNjfcVJ5sxVeEWqPkmV1sRduobKhJLGEY3ZsWmZ:uyQltmBlxuXfjq2sgDrNjfcVJ5sxVebO
- TLSH
  T1E3E2180873E8C654EEFF4E759C3565600372A0839D57F79D0AD1A0AA0BB3B908E51F93
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral11 behavioral12
- Target
  XWorm V6.4/Plugins/Clipboard.dll
- Size 14KB
- SHA256 c3a56127a1a31996ed51c202a77a4814108407e3d78135557a22f90850ab2288
- MD5 a919838fc8f94e318e8cd5d31fdb911e
- SHA1 46512b79dda369deca849349c44e748a981ff336
- SHA512 9f83a9804c350f1befb913703c0c39c2a30d2b636649fc94fddc27511fdf014adbf0733a8f0d342df769e39a81ad5cf06f8de865819dbd325fa24f5efd04255d
- SSDEEP 192:pph23MhInehHXpqRxry1/X7eOFXgNTer149iY6IW1mX/YvXa77WLusU:+BeJGxy/X7eUSTe5Wi2X/T/sU
- TLSH
  T13F522B9863E4837DC6FD0AB35C73B2401774C705EC02FF2E1DE860A15EA7A99871276A
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral13 behavioral14
- Target
  XWorm V6.4/Plugins/Cmstp-Bypass.dll
- Size 11KB
- SHA256 5b5f4dd71e4fcd7703670e888bf1d2eaf1a5c7834ddff50b869044b39a2e07da
- MD5 82bfe3551669209ba9ea264d41a17cd8
- SHA1 c3b9dd7cbec22d07f47605d4f3d740a8adea4020
- SHA512 05c6694bb725a0d02a5b5d2ffcc868e86b935778a048392bbe51c90f7a6b60d4cee9dcac3bcfceec026c5afd4c2fce11a4e19445f591b50cda2d0e5abbdd974a
- SSDEEP 192:KXpS1QWlPgiqdEquP+GGO9mWbpGkjgyaYcIW1vr/8T4U7aL7+WLEO0AhdW5:K5cjP20mWbEkUyaYir/o4JL7W8
- TLSH
  T1BF32082DA7E18275CD7E0E7248A7E3010771DA44DD23FB2F56E4A10A5D7B38883B2676
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

8^/10

adware persistence ransomware spyware
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral15 behavioral16
- Target
  XWorm V6.4/Plugins/FileManager.dll
- Size 679KB
- SHA256 f31e59350ab8d78919d064e17bb9c4b4e86cf9942c0060188bda7e9bff578e9c
- MD5 ebefb5995e4588574cd92e7048070308
- SHA1 c81e64f8614cefd02cf0e5345e17bf23cc1cabd4
- SHA512 ad48ee5d65f8840e501e74665a77a59cfade1cb78c027f60bd3cc888b858282e42c23716115488fe3f61c7ec211fbed18fd8ef8586ed3ff1a46413acd5a4bb2d
- SSDEEP 12288:Elr7BUE5n+/zlbI9gJvjEWKgpKhGOXoDDDp0b:ElB5n+/z1I9SblKhGO6DDp0b
- TLSH
  T1B8E409203FE8F01FE29A73B6D4D187214BB4A6427296FF8F258446E81C937895C594BF
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

8^/10

adware persistence ransomware spyware
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral17 behavioral18
- Target
  XWorm V6.4/Plugins/FilesSearcher.dll
- Size 478KB
- SHA256 0485f40ff9646e4fe5f79a842d680e2ba5ab96a7dc74a2e3d557e91f6e3a35bb
- MD5 5453702f3bc9b3d8971d48ea0a9d6114
- SHA1 52f8c00cdd687972d651278f3397a596c4c4b0f5
- SHA512 0dd473936210fe7669d3adccd663b50ea20c905d4dee60a857726859406c0cfcafed8c53e7214fd019b0c956018ebf0e0242de770f7ab6d95f73ef97268133f8
- SSDEEP 6144:WAHdfUpnnBuIbE7SCQeGtSV41QJDsTDDh0Yhe6dwxLV/0uhg0B6yORUlKL5i+:3VUpnkZ7slS4Ys50ie6Cf3g0PT6s+
- TLSH
  T118A49D412BE8C647F1BF27B2C0E252A1C7B0E455A62EEBCF5D8424EE1D17350E9117AB
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral19 behavioral20
- Target
  XWorm V6.4/Plugins/HBrowser.dll
- Size 25KB
- SHA256 a8ec5c5e44b81766bfa93eded535484d3f85fa026bda7a5492ab0665557b9e42
- MD5 02630e18ca44a1b38558156d0a6de6f1
- SHA1 d4813541cfcc106f190934d5392b5179d44073a2
- SHA512 dffa9a4c84d195349fb1e88fb097b77829cf557ee229bb59ca42cb28c588b6976b1016b382597d1fac31a624b009662db41765f7eceedb26a415074daacc16d7
- SSDEEP 384:Kp33X3L5/QrX8nB9d13+6HGLReMWaFnp9l/1DRVTbg0Ut4xh+7fYMoKABnR:KR3nL5/QrQ13ORR9bTbz+7YMoFBR
- TLSH
  T10FB25B4967F49630E1FD0A7598B367148370FA935812EF8F0BC9641A2E3B7E446247EA
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral21 behavioral22
- Target
  XWorm V6.4/Plugins/HRDP.dll
- Size 1.7MB
- SHA256 053f0276f94591724487dc51bb04d15a598a8e608ed80a2b6c1b7c8845095531
- MD5 4ec65b69a58d03fd95a25c1678e9367b
- SHA1 954d85f6c328d4a4b48ac090f17b640fa6f54e97
- SHA512 14388f53efe1d41093b45b108c44db8f32fd2b35907950476ee603c797d4175b67d067f7d0e656b6a0bca538b1d392bb47867d1a47cefb1b997dd6b18bfefd77
- SSDEEP 24576:UrKxoVT2iXc+IZ++6WiaTAsN/3ebTvK+63CWH8iA/iD2hgPjcC8SVdKumYr7:RHZ5pdqYH8ia6GcKuR7
- TLSH
  T166851918F6D8423ED857D2359A7153B2D7FAB9482F20738A2928075A7F2B3D02B3575C
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral23 behavioral24
- Target
  XWorm V6.4/Plugins/HVNC.dll
- Size 85KB
- SHA256 db44feac5462370d1b3b7050806509684acf3e2fd804c1b2817867c44441de25
- MD5 e608fb6e14a699106e9cf1d1f5e4ae91
- SHA1 835630b7128e29052db9b3784cf9d6ca5a8b1206
- SHA512 053b744c88aa0450460aaac24107ccdc724bfa1636cffd308993331a849ffc2b0a5f0abab1377f1a39dce8835641ed9de73d417851e15605d2172c7996e1ba47
- SSDEEP 1536:vqhezETwSM9jwX0o71Us5XttkzU3mfICaRUlh:yhezxpjwRp5XttkzUMIC2Mh
- TLSH
  T1DE832889A3FC4610F1FF5B7598725A204BB1F5532932DB1F22E5906E2F777818920BA3
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

8^/10

adware persistence ransomware spyware
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral25 behavioral26
- Target
  XWorm V6.4/Plugins/HVNCMemory.dll
- Size 39KB
- SHA256 f1f362067d0e613b844e961c9b5c380f95cfa1333436e3431ee3accee1807804
- MD5 b4e4c31850ab3d32f71fabb658c77c26
- SHA1 2071c1d767d4fa868a1e48438d862a98b42b7251
- SHA512 4a9c506b24b6e3d0aa03a1d15244507318e1303c0f7790db735be4ed056488da39ccd07c27ec8b3617bd951335e670d1dd9d5131016b7c9d32236a05cf418533
- SSDEEP 768:xEyXMCBlQ6Kms0noGYMyKgDWj81Y6Mnx9oQog1zqGnf:xLXTa6bX81Y62o87
- TLSH
  T1A0034B4A77FA0221F1FE0AB5CC73A7289331F5934516D70E2AC960696B73682C510FE7
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral27 behavioral28
- Target
  XWorm V6.4/Plugins/HiddenApps.dll
- Size 45KB
- SHA256 3f24e2ed2972d3987bb189fe69830ab8a4ab56588db0ef0763145a78558abebd
- MD5 ed681170501c5728202e0eaef0c156e5
- SHA1 119eb6e56c58f0e5d7faa06a993be01db378804e
- SHA512 c32d3d21e3d1082c2b2063ce7d5703817376d8318c8720908ec38c64c3bfee1dac54a531c0537a66e0f5e65ce63c12a340ccc416f76b3ae76391dca2baa841f4
- SSDEEP 768:kEN0W4dmvWt9VG2LqIvwYGYRpXpWk/x0qqBi3qMG0gpfN3ff+I1:kdmvWHVGMVwtYRtpl/x5qIXdEdX+w
- TLSH
  T1F2233848B7F88620E1FE1B3AA87363149374F4A71A16E74F0BC6A0592F723C45758BD6
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral29 behavioral30
- Target
  XWorm V6.4/Plugins/Informations.dll
- Size 22KB
- SHA256 4095ed7530b08663ed77d4adc03877a6676aa9f3b815b0ab2e0111d4e74f95ac
- MD5 c282a450afd60bda7c81370a8d031445
- SHA1 1a16d6e6584ab286ca6dc9f6f199b3d348397a00
- SHA512 d2479a6642c55a6a3cfb61696a3845ebef8a67b0db8d58e5ca36f89d440e4276f98cfc91b64dc31cc494a1a4ba67df3b5f453cb4727c51161376dbe7f2eded38
- SSDEEP 384:qCUEeL4D574MvGjydqXwxDJlw0n3TmyxhxJNgSg4eOF6K:qCXeL4DSjydqXwx1lZjfNnl
- TLSH
  T102A22B5837F986A5D2FE1EB14C32924543B6F60B8C12EA1F2DC8909E1D63B84CB55B73
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

8^/10

adware persistence ransomware spyware
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral31 behavioral32

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Active Setup

T1547.014

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Active Setup

T1547.014

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Targets

Boot or Logon Autostart Execution: Active Setup

Enumerates connected drives

Boot or Logon Autostart Execution: Active Setup

Enumerates connected drives

Boot or Logon Autostart Execution: Active Setup

Enumerates connected drives

Boot or Logon Autostart Execution: Active Setup

Enumerates connected drives

Boot or Logon Autostart Execution: Active Setup

Enumerates connected drives

Boot or Logon Autostart Execution: Active Setup

Enumerates connected drives

MITRE ATT&CK Enterprise v16

Tasks

static1

behavioral1

behavioral2

behavioral3

behavioral4

behavioral5

behavioral6

behavioral7

behavioral8

behavioral9

behavioral10

behavioral11

behavioral12

behavioral13

behavioral14

behavioral15

behavioral16

behavioral17

behavioral18

behavioral19

behavioral20

behavioral21

behavioral22

behavioral23

behavioral24

behavioral25

behavioral26

behavioral27

behavioral28

behavioral29

behavioral30

behavioral31

behavioral32