Extracted

• • Target
    Reg2026.vbs
  • Size 4.2MB
  • SHA256 392d0c5232ff4b9ba747b8b8db862a4a97f01f672fb1bcb10925274d5e829f8c
  • MD5 bf5e9b9a6bade2c2398b48bc83f92180
  • SHA1 7d93bd8abf59625fe08fc0e1ab3b3b7ee3cc6707
  • SHA512 a25fc407e01bbf6a013c0e8c0381670645e56c85a93b52a5576a1cbec65382509c5ba73a375d6ca3c66d650cfe67f3a11f372b6ee90924b03f678c251bb614d9
  • SSDEEP 24576:2krESY5SLidtedYHNGvr4SCt/GlNZEPsl/9OqjZBdpN7NIv9JFAsiP4kjqYlPbcv:k5B
  • TLSH
    T14B268E516E5859F9EF8C6A0E90AE6F1D83F042176A33706BFB41DF04BD9A341864B21F
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defense_evasiondiscoveryexecutiondonutloaderxwormloaderpersistencerattrojanadwareransomwarespyware

  • Detect Xworm Payload

  • Detects DonutLoader

    loader

  • Family: DonutLoader

    DonutLoader is a position-independent code that enables in-memory execution of VBScript, JScript, EXE, DLL files and dotNET assemblies.

    loaderdonutloader

  • Family: Xworm

    Xworm is a remote access trojan written in C#.

    trojanratxworm

  • Boot or Logon Autostart Execution: Active Setup

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

    persistence

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Adds Run key to start application

    persistence

  • Command and Scripting Interpreter: PowerShell

    Using powershell.exe command.

    execution

  • Enumerates connected drives

    Attempts to read the root path of hard drives other than the default C: drive.

  • Indicator Removal: File Deletion

    Adversaries may delete files left behind by the actions of their intrusion activity.

    defense_evasion

  • Executes a VBScript file via the Windows Script Host.

    execution
  behavioral1behavioral2