Extracted

• • Target
    Reg2026.bat
  • Size 2.4MB
  • SHA256 f498ddbc41b105f493ee4d1993438e8f611b4c5977dfab7a2b160832f2b56153
  • MD5 8e3ca03e5065e6848ba4cca96f8f01c9
  • SHA1 41b2fcdab4f9e68c0f75ae069e1681c41de60065
  • SHA512 6dc95c4a660b8bb4a9e7582a319426e57075c8d9393a365cf439637d9e9ebbbce45223ae8f8b802849ed02f9394d88f69b5371b85deff8fd559f498230fae3d1
  • SSDEEP 24576:SkEzX8secIuYkpR034slanDSb2PcymHpGlnyfEpuTB8bgh7Ik9Ts:2yBuhBXXAte
  • TLSH
    T1B4C59E0B48E72A3D97D4320D50BEE64F2E9051B7AECC156FDA2529697DBB94CC00F0E6
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  discoveryexecutiondonutloaderxwormloaderpersistencerattrojanadwareransomwarespyware

  • Detect Xworm Payload

  • Detects DonutLoader

    loader

  • Family: DonutLoader

    DonutLoader is a position-independent code that enables in-memory execution of VBScript, JScript, EXE, DLL files and dotNET assemblies.

    loaderdonutloader

  • Family: Xworm

    Xworm is a remote access trojan written in C#.

    trojanratxworm

  • Boot or Logon Autostart Execution: Active Setup

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

    persistence

  • Executes dropped EXE

  • Adds Run key to start application

    persistence

  • Enumerates connected drives

    Attempts to read the root path of hard drives other than the default C: drive.

  behavioral1behavioral2