Extracted

• • Target
    2026-07-08_46394364fea108ead3ba0df26b2f5972_agent-tesla_amadey_icedid_luca-stealer_njrat
  • Size 2.0MB
  • SHA256 0e3438a54fcdee6d017e56ed6dc3fc9f5c0bf8e3b3907486a5868dca5266e7c5
  • MD5 46394364fea108ead3ba0df26b2f5972
  • SHA1 6780fa212a059076f035ba5536c6f4fcf85f0f07
  • SHA512 5a9d64419a9dd0dd316e08e341a20383e4817a849816abee1b38ca7c1346d90ec70b825c4f9b393dfb19f0f8af48f8668417020e018d7736722377451d99f6cd
  • SSDEEP 49152:91H4jR2TYrQbDTr7Cbi3Nf+5jsI7W/Vtc7PWzOLs:gUSb2U5js72jWU
  • TLSH
    T1C0A5DF0573E442DDFEABE1768613C50BC7B178490777861F06A0AA766F33B716A2E321
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  discoveryexecutiondonutloaderxwormloaderpersistencerattrojan

  • Detect Xworm Payload

  • Detects DonutLoader

    loader

  • Family: DonutLoader

    DonutLoader is a position-independent code that enables in-memory execution of VBScript, JScript, EXE, DLL files and dotNET assemblies.

    loaderdonutloader

  • Family: Xworm

    Xworm is a remote access trojan written in C#.

    trojanratxworm

  • Detects Windows executables referencing non-Windows User-Agents

  • Command and Scripting Interpreter: PowerShell

    Run Powershell and hide display window.

    execution

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Adds Run key to start application

    persistence
  behavioral1behavioral2