Extracted

• • Target
    2026-08-09_0b0235a35f69695cb4f89c6e9845ad4e_hive
  • Size 1.6MB
  • SHA256 2762e7493c181a121eaa601a35824ca95c4db54859e015f4653ec31364134e3f
  • MD5 0b0235a35f69695cb4f89c6e9845ad4e
  • SHA1 bcd63fc42a2d54b000cc0bb8830c200ac6f67a7e
  • SHA512 91132a5bed1f51114da9c15c4e03b275efc4f738507ea769e232525c39ffc8b9a24874b950f55f7c6584d86d3a040e4ad9ddf52e42ce3609f63e262e5a137d00
  • SSDEEP 49152:RO+ZvuVfuoc2FBkgtmRlH7VV3U209i5usO4Z:l0V/VFBkTv7ic
  • TLSH
    T1E17533B4A2CC6C30FED242B1C696E1903A5A756D593D731D68AF132CF6E91A14C386F3
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  executiondonutloaderxwormloaderrattrojanupx

  • Detect Xworm Payload

  • Detects DonutLoader

    loader

  • Family: DonutLoader

    DonutLoader is a position-independent code that enables in-memory execution of VBScript, JScript, EXE, DLL files and dotNET assemblies.

    loaderdonutloader

  • Family: Xworm

    Xworm is a remote access trojan written in C#.

    trojanratxworm

  • Detects Windows executables referencing non-Windows User-Agents

  • UPX dump on OEP (original entry point)

  • Command and Scripting Interpreter: PowerShell

    Run Powershell and hide display window.

    execution

  • Executes dropped EXE

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  behavioral1behavioral2