Extracted

• • Target
    234.exe
  • Size 1.4MB
  • SHA256 cb22ecf141895afa986c898edd2961d8ddbbd8f4515cd8bb48e36a93d582dd81
  • MD5 603c906ec78696432246cff6f1f54422
  • SHA1 a3834604f63f9696b1151c10c785650fe705f7a4
  • SHA512 745a7b7695eccb1a1a35b36fd45f1b651416ade1c283db9183c9c107c638643d6776612b8a9c560d67e911945380bc1fd79888b014cac4930530164369bbc29a
  • SSDEEP 24576:4sn+WMSDlfDCtQvbsfHOSeGpHMQzhI4TFHF92hSelWb:9nPMGWteGpsQzWiBoSel
  • TLSH
    T1C2659C16E3D812ACE527E638CA619332E67178464371EACF0B98D6591F73ED06B3B311
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  executiondonutloaderneptuneratxwormloaderrattrojanpersistence

  • Detect Xworm Payload

  • Detects DonutLoader

    loader

  • Detects NeptuneRAT stealer

  • Family: DonutLoader

    DonutLoader is a position-independent code that enables in-memory execution of VBScript, JScript, EXE, DLL files and dotNET assemblies.

    loaderdonutloader

  • Family: NeptuneRAT, MasonRAT

    NeptuneRAT aka MasonRAT is a trojan written in C#.

    trojanneptunerat

  • Family: Xworm

    Xworm is a remote access trojan written in C#.

    trojanratxworm

  • Badlisted process makes network request

    Network request originating from process or tool commonly abused by malware.

  • Command and Scripting Interpreter: PowerShell

    Run Powershell and hide display window.

    execution
  behavioral1behavioral2behavioral3behavioral4