donutloader | c7b018e3765214536e59f151cf8d6596b70b52535291d89e88af9fc1a5de46da

Sharing

Copy URL Twitter E-mail

General

Target
XWorm 7.4 @vindexlink.zip
Size 73.0MB
Sample260708-q6f1psht3k
SHA256 c7b018e3765214536e59f151cf8d6596b70b52535291d89e88af9fc1a5de46da
MD5 235cb932d8bbc26a309822c8fe1ef4d1
SHA1 69bc7893e051604a7e40c0b71e80c91becb0170e
SHA512 6e1333104690054ac9687ce5260cfbd6968de6d6aa496cc6f4c10fc51b1f57f522d8b2f696df6affdd526f1df949ccf0cbf3952c95b6173f0a58832a7685d0e3
SSDEEP 786432:ro9LGqVJr6dlXbjz/ZIm6M3lp9Oz9qUI5lH9bSUFQheMjn5fTPf50v/zwq+YRSKK:reLk/ZIPsp9c96J9RmFfjOvUmLOt
TLSH
T11CF733DB48BC9215D47897EB36B046EF8A51EC001A1CBA2975EE94BEBC7C5092C7F40D
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Targets

- Target
  XWorm 7.4/XWorm 7.4/Fixer V7.bat
- Size 122B
- SHA256 a11703fd47d16020fa099a95bb4e46247d32cf8821dc1826e77a971cdd3c4c55
- MD5 2dabc46ce85aaff29f22cd74ec074f86
- SHA1 208ae3e48d67b94cc8be7bbfd9341d373fa8a730
- SHA512 6a50b525bc5d8eb008b1b0d704f9942f72f1413e65751e3de83d2e16ef3cf02ef171b9da3fff0d2d92a81daac7f61b379fcf7a393f46e914435f6261965a53b3
- TLSH
  T10DB02B177482E290838004430271224D39FDA002C291F2C375224530CD84CF0C333795
- MD5 SHA1 SHA512 TLSH
Score

8^/10

adware persistence ransomware spyware
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral1 behavioral2
- Target
  XWorm 7.4/XWorm 7.4/Plugins/ApexLogic.dll
- Size 1.4MB
- SHA256 3b2630e3433dd2d50df05f6743f8c5bf4be0aaaefd0b7e1cd2cae92cbf024830
- MD5 86d9a66323a7ecae53bd8a41dd76c174
- SHA1 13027c2fe9ae978bbc3b0911e4db1695a648ddbf
- SHA512 fbb7ff523b470629ebcd02f6d389f621999030fad28fbabb8e5b503d4f7b43b256d92028986e5cdedbce8027446435eb9a51a14101e98b16f2032f262692c876
- SSDEEP 24576:QLIrdj6cRIwi3etcihIXvcQizAaUkEVGEEofvStLue+Zi:7Jj6eOGcb0QgAa1EVGEh3gAi
- TLSH
  T1226512B9381BAA2BC764C73FC1D65829F13E94B391C26B6F249387104F026E9D7C6719
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral3 behavioral4
- Target
  XWorm 7.4/XWorm 7.4/Plugins/AuraNode.dll
- Size 220KB
- SHA256 7bafd173a30e599d670b91427b7d24795143f0d77c09dd6c9fca13af150a4c6f
- MD5 d84f14824405bbb10da2bb126965cb8a
- SHA1 7daf80b867b8c132ff6fd8893444548dad070cc9
- SHA512 97c63fcbe72f9f07953604b0905146d4c19678b1fdd50827d2c6469e27e0c66defafe2cad6b035c11d80f740f383121b95b255c5be6125e13c58f6c739365318
- SSDEEP 6144:uAVH9ZtyXefRYiXMhAOw0zBii/0dSw6l:uAJQXe6ic6Ow0zBii0dSw6l
- TLSH
  T137249EA43A566632EB2E8B3FC093780DD13EF7731383979F295706454E166F2978AE04
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

8^/10

adware persistence ransomware spyware
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral5 behavioral6
- Target
  XWorm 7.4/XWorm 7.4/Plugins/BerylSync.dll
- Size 263KB
- SHA256 2a01b2d43c5cba2b14fec1e59f1651aa30febc558e5b23e2c9d99df2e9f53e7f
- MD5 555682b2e3844000d46db1939ed17422
- SHA1 2516555f1028474a0cafc569fa3ab91c29acbfe0
- SHA512 5986b4c093f3f70b78878b59b46ad49b972e37c33de9ffe7257fc2f68d40e994a47ca04a4c3b21e5bed8e2ee12440726a816359ceda3828023129971b8b9fe4b
- SSDEEP 3072:Bs/ztWljPmg6tpgx4yDKNLEaX9Sg3LZ3j2kMZZbJVBVrLBctDUP0TPFBEZRt:G/R2PmaxMdX9NxjnMZZ7Pow0TF
- TLSH
  T1AE44AEAB3456566AC76DD73EC2EB9829E13ECA771F43675F289317108D026F0D78AE00
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral7 behavioral8
- Target
  XWorm 7.4/XWorm 7.4/Plugins/CinderFlow.dll
- Size 440KB
- SHA256 f370cc92d6e2ccbc519ff560030d3f14183f3a3d6904d2200bfc592d52b8149b
- MD5 54102735721a2b52fa0495c265bd4f7a
- SHA1 8b5a4fc3ee86d236e602b595be42dae56018ccc3
- SHA512 44c4f5a894c49db391533571eecd525e033fcc19ce8d3674c2e761a48fc6bffa4cce4ecec12fce075b9406ab59b5d32e7e440084e6124f789256d8a9b132abb0
- SSDEEP 12288:O/jpw3TuuSvxojZ81WaQZvT7lRBkd9+zvWE:O/Gjulqjq1WfZ7A
- TLSH
  T1C1A4D0F635625A23C72ECBBEA2C35C19E03EDF7326821A5F189366008C427F5D787A15
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral10 behavioral9
- Target
  XWorm 7.4/XWorm 7.4/Plugins/CipherLink.dll
- Size 2.3MB
- SHA256 9a71ea7367b53600b8579599d762766849e1e6750a2f05c8ab2030d6cdf78b30
- MD5 8370d4046a02221979a8ec114814df25
- SHA1 37dfc83d0b49bd7a196f97e8fd0bfae8eb8285cd
- SHA512 991e8511cdbc7bee6d4493f7f21bbcd882b3b5a5e579a266d304aedfeca82378b0fbd886729bf15a8c3c7ec8ec0e0da02510b132d9ae1fbb8198fa1e609aa96d
- SSDEEP 49152:OxU+gkeZAyUPrHeh07ThlBUh7//4u77cIAUH4c+OSupJL:OxM2Lq//Rfcnc9x
- TLSH
  T157B50105A7E885EBF1BB93B8C8A28441C7B1BC059775DBCF2B4019EA2E177908D35763
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral11 behavioral12
- Target
  XWorm 7.4/XWorm 7.4/Plugins/CosmosEdge.dll
- Size 228KB
- SHA256 88b08e71e67f0f4610e96e667d4b7f331ea5aa5372f13fbcabbbbbb41ffde73a
- MD5 efbac3eecc4a904fe0fa77074a4ac441
- SHA1 2793230d9bab508888736ff8a89d0256805c04ea
- SHA512 1e628b12d6005698b2c3a06bc9421e91847b1a2a039e7e02afa89a963f6a27edee15959b26c69257c8c7a897fb487615f47fab53afc4ff9efb0f4a314140fcb8
- SSDEEP 6144:xLEMzYxiN+0bMOAyiVKT3Q+85WMuQw3pl9Z:xLjXMKiVKT3QFjuQw3pln
- TLSH
  T10D34AEF739651923C72EAF3F81A34925F13D8A7B4B039AAF18D706144D566F0EB86E00
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral13 behavioral14
- Target
  XWorm 7.4/XWorm 7.4/Plugins/CrypticPulse.dll
- Size 1.8MB
- SHA256 000cfccf2026b977748dc32e9c4ae8e5cb6e726ecf2554598ad44464e91cb6be
- MD5 0c95aa98ee51260d0c419ba134f6ee20
- SHA1 cf850d7b6f44a21586484fda52deef2c8f42deda
- SHA512 b823c8fa228f9fd073fdd1a9c12ab01821e28eab12737823c72293884970b5472c01bf4e5e1cd7154d7b1b5cbbb691cad554a5c73464f05f95b88bf87c12f594
- SSDEEP 24576:8cCs4uvW4jfb2K90oo+C8JwUZc0PY0yNuVC9Hbv50eFGPlfDp6XssJxSPH:8H7uRfbQswUZcSByYGv5uZEdSv
- TLSH
  T1D0959D12B7D6D1BED1AE40B98A774919E2B1B8405B25CBC79AEC133D1F233E05D3A316
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral15 behavioral16
- Target
  XWorm 7.4/XWorm 7.4/Plugins/DaggerPoint.dll
- Size 367KB
- SHA256 5ec512b958e6884d4586e331d13eaec6fc64bca53886f89340b8edfe8b37e26d
- MD5 30b444e0ebc7f3a5764b12af74a9a2c2
- SHA1 9a1f87e8fefb56def66c7faab58c118412243607
- SHA512 5417f1400252f565fd76b54b27abfbfff173b6824b1e8fb92da68b8c9bedd33632a9b713f0df527af283cbc31b127a53e821817c3171f7b68b9e5420d3a58943
- SSDEEP 6144:v3KIHG5oKl37LtfSyUemqexCwpvZeyajh2dZ21PSwqDS8hl7rCZFo2xX:yJnft1tTuCTyat2dZoqDS8hlvCZFo2
- TLSH
  T1E184DFA8393955B7D62EE73FC0C39465D13E92F32243AAAF246362304D125F4CB97E16
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

8^/10

adware persistence ransomware spyware
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral17 behavioral18
- Target
  XWorm 7.4/XWorm 7.4/Plugins/DivineMesh.dll
- Size 83KB
- SHA256 680ec3a3e7a90dfedc1e572e25cc1a17a1782e882005d88e53db9965136b81b1
- MD5 ff94c16016c40e70013db9321ffe9926
- SHA1 60e11f4def0fe9459f5d0ee87059621870964867
- SHA512 8040180f232ccbaaae36384c959592bb23000587dda454c9646cb748ce639b6c046edb061919060d7b961a061997905d91076116b1d0152961bdd7ac86a58c8a
- SSDEEP 1536:qPJayHUz3L54RRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRDCHZO7iJK8NWI9I1k:Op07wC5O7BI9IQmMGyNz
- TLSH
  T1E38329C496F3C566D6C86AF711937E1A2674418731C2FB220BD7C998EE87AC15AC3873
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral19 behavioral20
- Target
  XWorm 7.4/XWorm 7.4/Plugins/EonVault.dll
- Size 1.6MB
- SHA256 068008c26dd532a06e14394ec3a31917906c797582ca9d7c7bedf41a12740b09
- MD5 0815539e99c6af573e16cbc0ff402342
- SHA1 7917994c52fb898e865e1f93b64c67e350fe47e8
- SHA512 1823330ca717b797f6a266d5b92937d0baba2ffca5ba40a0b2715557b64f48b0063d6cca54a8d1a7e8bee12aca90f624ae26383b7a50d856baf05ed283266f76
- SSDEEP 24576:TCs4uvW4jfb2K90oo+C8JwUZc0PY0yNuVC9Hbv50eFGPlf:+7uRfbQswUZcSByYGv5u
- TLSH
  T10A759F62B69AC1BAD4EE80B9897B961EF7B6784407348BD712D4172E1F337E01E39311
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral21 behavioral22
- Target
  XWorm 7.4/XWorm 7.4/Plugins/EtherNet.dll
- Size 14.3MB
- SHA256 351d24433567b9ea704c2e4a884807752aee0eb513bf45dc7e0bc678a57c9f54
- MD5 8e1ff68af99336ba3faedc518dfc0d52
- SHA1 e434dd76b40b721a6e1dc690e7fdd8a90b5d20aa
- SHA512 1ea22a94e86f6013eb947f3e0af88caf783c2a493dfd68b24fc4d3acf2cbd91f217a3d21ccd192b82170b472cd2bada2393f7a7cd166783afc16ea1c3940856e
- SSDEEP 393216:i2HsIHU9aAPwDbbpNGKSWpyCH/5/bxY4H:i2TyobtwYp3FH
- TLSH
  T114E6237C74D4E8B3DBE601B68D6022F2A63EBC17F7C1B4B9984E871049273E9ED21456
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

8^/10

adware persistence spyware
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral23 behavioral24
- Target
  XWorm 7.4/XWorm 7.4/Plugins/FalconScope.dll
- Size 2.5MB
- SHA256 89dd2e64dcec3143d5dc4674b05c3fc91fe16ae62569396994f9c402160b7249
- MD5 e28e7b320648f887f69410816682685a
- SHA1 c16ad409d23467396076e5531d7c9a6ed050785c
- SHA512 e66af234ad1e242d278a06fb05f0dd54fb33d1da7dc2ad6a80673890f470f2d62832d488e46e4ce9282705489fab42e311360ffb19cce1b2f780e617b2b7abeb
- SSDEEP 24576:B6jLLWCs4uvW4jfb2K90oo+C8JwUZc0PY0yNuVC9Hbv50eFGPlfje7eelX6jTQa8:B6jnt7uRfbQswUZcSByYGv5uZseNpG
- TLSH
  T12FC56C4162C5AEAFD76C01B5B6A29A0493B5F4845B23FBC7569E237C1F2B3E00D76321
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral25 behavioral26
- Target
  XWorm 7.4/XWorm 7.4/Plugins/FeralCore.dll
- Size 252KB
- SHA256 5b95c28895caa93432b74252cdeddb35f687a19f85b52613fb617ada2e847717
- MD5 f083da4d26fa99cd36c81a2b7775597e
- SHA1 5cefdb89edde28e52c644756534a3217f21c5fc2
- SHA512 c9c5684d10baa47fcbb7a279e1c9e192abce54f1fd1934d04644d2f5a35657db7b92fac0bcfbab567acdb877c7f5373b8ecc3fb7f643711bb75ef85bb5928d5e
- SSDEEP 6144:2F/sQ08FH0Q9kaHEODGVxcdF61lpLm4XtH15w:RGH0Q2aHXCxe6h
- TLSH
  T13A449E7935295922D7EEC73FC28AA899D13FDAB31342676F18A326103E429F19747F04
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

8^/10

adware persistence ransomware spyware
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral27 behavioral28
- Target
  XWorm 7.4/XWorm 7.4/Plugins/FissionGate.dll
- Size 16KB
- SHA256 b811703326822407e49ea0c1151e962470e8dc5bd23fe19c61f3200a794cf998
- MD5 6e83657f22d2096b8cb4791941bb8300
- SHA1 c4e756660db09cf7bd94782216f42166651b3f51
- SHA512 22e624a09df88cf530343efce63f89e1de62adb7873c9f651194656707eaa79e247b41d1e8c71b07b5f5b1387c32fab66372322b78ee3701a038ff1ef00c050b
- SSDEEP 384:LNsDP97BkZ3pBkHEk8G1QxFUzTNnrYFXoMZlS9xPCn:LNuR+ZZ+mScWfEoMZQ9xPg
- TLSH
  T1B57229AC67F08371C6BD0BB24872A2026B71D605D853FF5E5CDC70960EA7689C784BA7
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

8^/10

adware persistence ransomware spyware
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral29 behavioral30
- Target
  XWorm 7.4/XWorm 7.4/Plugins/GraveMantle.dll
- Size 241KB
- SHA256 ba4aa361a80c4ea88f267d3eecde64daf69ce6f202838fed6ce36f656b4541e0
- MD5 c2c3ffd06709d4f7effa2ea650edab6c
- SHA1 ba564f311006d3212c0fecb0ec109bf50b00cbd7
- SHA512 36de83a82bc2b88a8f1fd78e32ca5fa4828128edc199ff3f0fd8a93249cf9ac13faba8a3fbab52ee4d807a74dc7164043f8d6df71eec6c0de9184e44a3fe5726
- SSDEEP 6144:RiO7BivAlibhrt59aNNihJePJpeDSbVvyXVkaHmEFfhb7RQhfw73Z5zaKW:UuABBLSoG3USbVvyzpb7RofwdBah
- TLSH
  T1F334AEA839261426C72FCFFE81D79419E13EF6B35F42665F28A70E114E123F4E64AE14
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

8^/10

adware persistence ransomware spyware
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral31 behavioral32

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Active Setup

T1547.014

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Active Setup

T1547.014

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Targets

Boot or Logon Autostart Execution: Active Setup

Enumerates connected drives

Boot or Logon Autostart Execution: Active Setup

Enumerates connected drives

Boot or Logon Autostart Execution: Active Setup

Enumerates connected drives

Boot or Logon Autostart Execution: Active Setup

Enumerates connected drives

Boot or Logon Autostart Execution: Active Setup

Enumerates connected drives

Boot or Logon Autostart Execution: Active Setup

Enumerates connected drives

Boot or Logon Autostart Execution: Active Setup

Enumerates connected drives

MITRE ATT&CK Enterprise v16

Tasks

static1

behavioral1

behavioral2

behavioral3

behavioral4

behavioral5

behavioral6

behavioral7

behavioral8

behavioral9

behavioral10

behavioral11

behavioral12

behavioral13

behavioral14

behavioral15

behavioral16

behavioral17

behavioral18

behavioral19

behavioral20

behavioral21

behavioral22

behavioral23

behavioral24

behavioral25

behavioral26

behavioral27

behavioral28

behavioral29

behavioral30

behavioral31

behavioral32