Extracted

• • Target
    kVh8GwJFrM.bat
  • Size 2.4MB
  • SHA256 01e4fc7fff58631ddc788b7f2c8865df297e5159b1137c0eeb236e7855f22463
  • MD5 fad99fb6af2427d8da99e9c1780fb101
  • SHA1 58f05d8879b9831c51414e4f2b7122a10b1b2dc2
  • SHA512 1e47042edf594b59745af9b079c66b45f4e37dc3d55daabaa94d59e6264b60860a4723657bb3452a2ad028467ea69c47fcb666c8fd4dfbdf042210b966006b08
  • SSDEEP 24576:W/LX8secIuYkpR034slanDSb2PcymHpGlnyfEpuTB8bgh7Ik9Tg:qyBuhBXXAt+
  • TLSH
    T1CBC59E0B48E72A3D97D4324D50BEE64F2E9051B7AECC146FDA2529697DBB94CC00F0E6
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  discoveryexecutiondonutloaderxwormloaderpersistencerattrojanadwareransomwarespyware

  • Detect Xworm Payload

  • Detects DonutLoader

    loader

  • Family: DonutLoader

    DonutLoader is a position-independent code that enables in-memory execution of VBScript, JScript, EXE, DLL files and dotNET assemblies.

    loaderdonutloader

  • Family: Xworm

    Xworm is a remote access trojan written in C#.

    trojanratxworm

  • Boot or Logon Autostart Execution: Active Setup

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

    persistence

  • Executes dropped EXE

  • Adds Run key to start application

    persistence

  • Enumerates connected drives

    Attempts to read the root path of hard drives other than the default C: drive.

  behavioral1behavioral2