donutloader | 6c70aa4d5db6567f56e8c4544aff4dcd10647cf9448bde4beacd08f5b437fdeb

Resubmissions

10/08/2026, 19:47

260810-yhmsca1zhz10

10/08/2026, 19:12

260810-xwr4jsab2910

10/08/2026, 19:00

260810-xn2b9awbqc10

Sharing

Copy URL Twitter E-mail

General

Target
XWorm 7.4.rar
Size 60.6MB
Sample260810-xwr4jsab29
SHA256 6c70aa4d5db6567f56e8c4544aff4dcd10647cf9448bde4beacd08f5b437fdeb
MD5 a886a345b0cf68b33d87de2e4a7db9c3
SHA1 1855c1184a87c0358c4f573bcc42db1a8f1e934f
SHA512 c46e66542a82ab6a3aa4799a57db7a862accc5d2c186bd576225be016e2b6710de27ec61db3dac091048f3518362d5c98d1a7232d9667ae5bc5b539a17b9aedf
SSDEEP 1572864:po1vAXSdOTHHblJzR7jMy8/UlbNq8wLWNj:pgvAidODHhJF7S/+o8w+j
TLSH
T1E5D7337AABFC3586F6F2424E949DAFC508FB7044A933A1E7E64A147F3794760110A90F
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Extracted

Family

ratonrat

Version

Professional

tico-32985.portmap.host:32985

Mutex

AG9XoBh66DbwilDMm9njguu

Attributes

assist
false
box
false
box_icon
Error
box_msg
I'm the message box description
box_title
Hello World
defender
false
delay
0
hide_file
false
open_website
false
password
t.me/junk_code
process_critical
false
raw
https://pastebin.com/raw/5BzQ82Z2
reconnect
3
startup
false
tag
Infected
uac
false
vm
false
website
https://t.me/example

Targets

- Target
  XWorm 7.4/MySql.Data.dll
- Size 1.1MB
- SHA256 b9974ec9c4b5453b6a00f2235edcfdcaaad931928c35faf8aac0bb57ef69d782
- MD5 94e00465e44f5782938e27df2dc7362e
- SHA1 2970ceef0c1e6cfe3b8714c428c8857c7b157ca7
- SHA512 25cd34b4ff0e2fe9905f836240aeeeb3202c62a9604c46ae4535016cbad43a31389b9ef11b2f6836ec5f458114aca97a1c63edbf9d598a24f35c7ab6be763e20
- SSDEEP 24576:Y/G6E9m5a3wZC7FuuDqUDcEepg7kiOKTt:9qgVLcEepKuK
- TLSH
  T103456C0037F9EA29D6DF9679E77596184BF1E905B102F75F1208E5A92C33B408E40BB7
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral1
- Target
  XWorm 7.4/NAudio.dll
- Size 502KB
- SHA256 81b3f1dc3f1eac9762b8a292751a44b64b87d0d4c3982debfdd2621012186451
- MD5 3b87d1363a45ce9368e9baec32c69466
- SHA1 70a9f4df01d17060ec17df9528fca7026cc42935
- SHA512 1f07d3b041763b4bc31f6bd7b181deb8d34ff66ec666193932ffc460371adbcd4451483a99009b9b0b71f3864ed5c15c6c3b3777fabeb76f9918c726c35eb7d7
- SSDEEP 6144:96/i10SZtfzWctj98vZcE0wmLlaIZs5eku2sX2hrjAzvgmXa6W9FwsT9idwktQZG:9yrSKMJR9aGs55T1X9Fwspi2tGpmS
- TLSH
  T156B45C2237E4962BD1AF5775E4E1191B8BB1F8423237D78F8684BB6E1D837924C407A3
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

6^/10

adware persistence ransomware spyware
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral2
- Target
  XWorm 7.4/Newtonsoft.Json.dll
- Size 695KB
- SHA256 e1e27af7b07eeedf5ce71a9255f0422816a6fc5849a483c6714e1b472044fa9d
- MD5 195ffb7167db3219b217c4fd439eedd6
- SHA1 1e76e6099570ede620b76ed47cf8d03a936d49f8
- SHA512 56eb7f070929b239642dab729537dde2c2287bdb852ad9e80b5358c74b14bc2b2dded910d0e3b6304ea27eb587e5f19db0a92e1cbae6a70fb20b4ef05057e4ac
- SSDEEP 12288:GBja5bBvR8Q0TE2HB0WLmvXbsVG1Gw03RzxNHgKhwFBkjSHXP36RMGy1NqTUO:GBjk38WuBcAbwoA/BkjSHXP36RMG/
- TLSH
  T166E4394123F98F2BE1AF6B75B4704E1543F9F917A6B5E78F9A04D9A91C43B408E403A3
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

6^/10

adware persistence ransomware spyware
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral3
- Target
  XWorm 7.4/Plugins/ApexLogic.dll
- Size 1.4MB
- SHA256 3b2630e3433dd2d50df05f6743f8c5bf4be0aaaefd0b7e1cd2cae92cbf024830
- MD5 86d9a66323a7ecae53bd8a41dd76c174
- SHA1 13027c2fe9ae978bbc3b0911e4db1695a648ddbf
- SHA512 fbb7ff523b470629ebcd02f6d389f621999030fad28fbabb8e5b503d4f7b43b256d92028986e5cdedbce8027446435eb9a51a14101e98b16f2032f262692c876
- SSDEEP 24576:QLIrdj6cRIwi3etcihIXvcQizAaUkEVGEEofvStLue+Zi:7Jj6eOGcb0QgAa1EVGEh3gAi
- TLSH
  T1226512B9381BAA2BC764C73FC1D65829F13E94B391C26B6F249387104F026E9D7C6719
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral4
- Target
  XWorm 7.4/Plugins/AuraNode.dll
- Size 220KB
- SHA256 7bafd173a30e599d670b91427b7d24795143f0d77c09dd6c9fca13af150a4c6f
- MD5 d84f14824405bbb10da2bb126965cb8a
- SHA1 7daf80b867b8c132ff6fd8893444548dad070cc9
- SHA512 97c63fcbe72f9f07953604b0905146d4c19678b1fdd50827d2c6469e27e0c66defafe2cad6b035c11d80f740f383121b95b255c5be6125e13c58f6c739365318
- SSDEEP 6144:uAVH9ZtyXefRYiXMhAOw0zBii/0dSw6l:uAJQXe6ic6Ow0zBii0dSw6l
- TLSH
  T137249EA43A566632EB2E8B3FC093780DD13EF7731383979F295706454E166F2978AE04
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral5
- Target
  XWorm 7.4/Plugins/BerylSync.dll
- Size 263KB
- SHA256 2a01b2d43c5cba2b14fec1e59f1651aa30febc558e5b23e2c9d99df2e9f53e7f
- MD5 555682b2e3844000d46db1939ed17422
- SHA1 2516555f1028474a0cafc569fa3ab91c29acbfe0
- SHA512 5986b4c093f3f70b78878b59b46ad49b972e37c33de9ffe7257fc2f68d40e994a47ca04a4c3b21e5bed8e2ee12440726a816359ceda3828023129971b8b9fe4b
- SSDEEP 3072:Bs/ztWljPmg6tpgx4yDKNLEaX9Sg3LZ3j2kMZZbJVBVrLBctDUP0TPFBEZRt:G/R2PmaxMdX9NxjnMZZ7Pow0TF
- TLSH
  T1AE44AEAB3456566AC76DD73EC2EB9829E13ECA771F43675F289317108D026F0D78AE00
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral6
- Target
  XWorm 7.4/Plugins/CinderFlow.dll
- Size 440KB
- SHA256 f370cc92d6e2ccbc519ff560030d3f14183f3a3d6904d2200bfc592d52b8149b
- MD5 54102735721a2b52fa0495c265bd4f7a
- SHA1 8b5a4fc3ee86d236e602b595be42dae56018ccc3
- SHA512 44c4f5a894c49db391533571eecd525e033fcc19ce8d3674c2e761a48fc6bffa4cce4ecec12fce075b9406ab59b5d32e7e440084e6124f789256d8a9b132abb0
- SSDEEP 12288:O/jpw3TuuSvxojZ81WaQZvT7lRBkd9+zvWE:O/Gjulqjq1WfZ7A
- TLSH
  T1C1A4D0F635625A23C72ECBBEA2C35C19E03EDF7326821A5F189366008C427F5D787A15
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral7
- Target
  XWorm 7.4/Plugins/CipherLink.dll
- Size 2.3MB
- SHA256 9a71ea7367b53600b8579599d762766849e1e6750a2f05c8ab2030d6cdf78b30
- MD5 8370d4046a02221979a8ec114814df25
- SHA1 37dfc83d0b49bd7a196f97e8fd0bfae8eb8285cd
- SHA512 991e8511cdbc7bee6d4493f7f21bbcd882b3b5a5e579a266d304aedfeca82378b0fbd886729bf15a8c3c7ec8ec0e0da02510b132d9ae1fbb8198fa1e609aa96d
- SSDEEP 49152:OxU+gkeZAyUPrHeh07ThlBUh7//4u77cIAUH4c+OSupJL:OxM2Lq//Rfcnc9x
- TLSH
  T157B50105A7E885EBF1BB93B8C8A28441C7B1BC059775DBCF2B4019EA2E177908D35763
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral8
- Target
  XWorm 7.4/Plugins/CosmosEdge.dll
- Size 228KB
- SHA256 88b08e71e67f0f4610e96e667d4b7f331ea5aa5372f13fbcabbbbbb41ffde73a
- MD5 efbac3eecc4a904fe0fa77074a4ac441
- SHA1 2793230d9bab508888736ff8a89d0256805c04ea
- SHA512 1e628b12d6005698b2c3a06bc9421e91847b1a2a039e7e02afa89a963f6a27edee15959b26c69257c8c7a897fb487615f47fab53afc4ff9efb0f4a314140fcb8
- SSDEEP 6144:xLEMzYxiN+0bMOAyiVKT3Q+85WMuQw3pl9Z:xLjXMKiVKT3QFjuQw3pln
- TLSH
  T10D34AEF739651923C72EAF3F81A34925F13D8A7B4B039AAF18D706144D566F0EB86E00
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

8^/10

adware persistence ransomware spyware
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral9
- Target
  XWorm 7.4/Plugins/CrypticPulse.dll
- Size 1.8MB
- SHA256 000cfccf2026b977748dc32e9c4ae8e5cb6e726ecf2554598ad44464e91cb6be
- MD5 0c95aa98ee51260d0c419ba134f6ee20
- SHA1 cf850d7b6f44a21586484fda52deef2c8f42deda
- SHA512 b823c8fa228f9fd073fdd1a9c12ab01821e28eab12737823c72293884970b5472c01bf4e5e1cd7154d7b1b5cbbb691cad554a5c73464f05f95b88bf87c12f594
- SSDEEP 24576:8cCs4uvW4jfb2K90oo+C8JwUZc0PY0yNuVC9Hbv50eFGPlfDp6XssJxSPH:8H7uRfbQswUZcSByYGv5uZEdSv
- TLSH
  T1D0959D12B7D6D1BED1AE40B98A774919E2B1B8405B25CBC79AEC133D1F233E05D3A316
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

8^/10

adware persistence ransomware spyware
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral10
- Target
  XWorm 7.4/Plugins/DaggerPoint.dll
- Size 367KB
- SHA256 5ec512b958e6884d4586e331d13eaec6fc64bca53886f89340b8edfe8b37e26d
- MD5 30b444e0ebc7f3a5764b12af74a9a2c2
- SHA1 9a1f87e8fefb56def66c7faab58c118412243607
- SHA512 5417f1400252f565fd76b54b27abfbfff173b6824b1e8fb92da68b8c9bedd33632a9b713f0df527af283cbc31b127a53e821817c3171f7b68b9e5420d3a58943
- SSDEEP 6144:v3KIHG5oKl37LtfSyUemqexCwpvZeyajh2dZ21PSwqDS8hl7rCZFo2xX:yJnft1tTuCTyat2dZoqDS8hlvCZFo2
- TLSH
  T1E184DFA8393955B7D62EE73FC0C39465D13E92F32243AAAF246362304D125F4CB97E16
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

8^/10

adware persistence ransomware spyware
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral11
- Target
  XWorm 7.4/Plugins/DivineMesh.dll
- Size 83KB
- SHA256 680ec3a3e7a90dfedc1e572e25cc1a17a1782e882005d88e53db9965136b81b1
- MD5 ff94c16016c40e70013db9321ffe9926
- SHA1 60e11f4def0fe9459f5d0ee87059621870964867
- SHA512 8040180f232ccbaaae36384c959592bb23000587dda454c9646cb748ce639b6c046edb061919060d7b961a061997905d91076116b1d0152961bdd7ac86a58c8a
- SSDEEP 1536:qPJayHUz3L54RRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRDCHZO7iJK8NWI9I1k:Op07wC5O7BI9IQmMGyNz
- TLSH
  T1E38329C496F3C566D6C86AF711937E1A2674418731C2FB220BD7C998EE87AC15AC3873
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral12
- Target
  XWorm 7.4/Plugins/EonVault.dll
- Size 1.6MB
- SHA256 068008c26dd532a06e14394ec3a31917906c797582ca9d7c7bedf41a12740b09
- MD5 0815539e99c6af573e16cbc0ff402342
- SHA1 7917994c52fb898e865e1f93b64c67e350fe47e8
- SHA512 1823330ca717b797f6a266d5b92937d0baba2ffca5ba40a0b2715557b64f48b0063d6cca54a8d1a7e8bee12aca90f624ae26383b7a50d856baf05ed283266f76
- SSDEEP 24576:TCs4uvW4jfb2K90oo+C8JwUZc0PY0yNuVC9Hbv50eFGPlf:+7uRfbQswUZcSByYGv5u
- TLSH
  T10A759F62B69AC1BAD4EE80B9897B961EF7B6784407348BD712D4172E1F337E01E39311
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral13
- Target
  XWorm 7.4/Plugins/EtherNet.dll
- Size 14.3MB
- SHA256 351d24433567b9ea704c2e4a884807752aee0eb513bf45dc7e0bc678a57c9f54
- MD5 8e1ff68af99336ba3faedc518dfc0d52
- SHA1 e434dd76b40b721a6e1dc690e7fdd8a90b5d20aa
- SHA512 1ea22a94e86f6013eb947f3e0af88caf783c2a493dfd68b24fc4d3acf2cbd91f217a3d21ccd192b82170b472cd2bada2393f7a7cd166783afc16ea1c3940856e
- SSDEEP 393216:i2HsIHU9aAPwDbbpNGKSWpyCH/5/bxY4H:i2TyobtwYp3FH
- TLSH
  T114E6237C74D4E8B3DBE601B68D6022F2A63EBC17F7C1B4B9984E871049273E9ED21456
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

8^/10

adware persistence ransomware spyware
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral14
- Target
  XWorm 7.4/Plugins/FalconScope.dll
- Size 2.5MB
- SHA256 89dd2e64dcec3143d5dc4674b05c3fc91fe16ae62569396994f9c402160b7249
- MD5 e28e7b320648f887f69410816682685a
- SHA1 c16ad409d23467396076e5531d7c9a6ed050785c
- SHA512 e66af234ad1e242d278a06fb05f0dd54fb33d1da7dc2ad6a80673890f470f2d62832d488e46e4ce9282705489fab42e311360ffb19cce1b2f780e617b2b7abeb
- SSDEEP 24576:B6jLLWCs4uvW4jfb2K90oo+C8JwUZc0PY0yNuVC9Hbv50eFGPlfje7eelX6jTQa8:B6jnt7uRfbQswUZcSByYGv5uZseNpG
- TLSH
  T12FC56C4162C5AEAFD76C01B5B6A29A0493B5F4845B23FBC7569E237C1F2B3E00D76321
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral15
- Target
  XWorm 7.4/Plugins/FeralCore.dll
- Size 252KB
- SHA256 5b95c28895caa93432b74252cdeddb35f687a19f85b52613fb617ada2e847717
- MD5 f083da4d26fa99cd36c81a2b7775597e
- SHA1 5cefdb89edde28e52c644756534a3217f21c5fc2
- SHA512 c9c5684d10baa47fcbb7a279e1c9e192abce54f1fd1934d04644d2f5a35657db7b92fac0bcfbab567acdb877c7f5373b8ecc3fb7f643711bb75ef85bb5928d5e
- SSDEEP 6144:2F/sQ08FH0Q9kaHEODGVxcdF61lpLm4XtH15w:RGH0Q2aHXCxe6h
- TLSH
  T13A449E7935295922D7EEC73FC28AA899D13FDAB31342676F18A326103E429F19747F04
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

8^/10

adware persistence ransomware spyware
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral16
- Target
  XWorm 7.4/Plugins/FissionGate.dll
- Size 16KB
- SHA256 b811703326822407e49ea0c1151e962470e8dc5bd23fe19c61f3200a794cf998
- MD5 6e83657f22d2096b8cb4791941bb8300
- SHA1 c4e756660db09cf7bd94782216f42166651b3f51
- SHA512 22e624a09df88cf530343efce63f89e1de62adb7873c9f651194656707eaa79e247b41d1e8c71b07b5f5b1387c32fab66372322b78ee3701a038ff1ef00c050b
- SSDEEP 384:LNsDP97BkZ3pBkHEk8G1QxFUzTNnrYFXoMZlS9xPCn:LNuR+ZZ+mScWfEoMZQ9xPg
- TLSH
  T1B57229AC67F08371C6BD0BB24872A2026B71D605D853FF5E5CDC70960EA7689C784BA7
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral17
- Target
  XWorm 7.4/Plugins/GraveMantle.dll
- Size 241KB
- SHA256 ba4aa361a80c4ea88f267d3eecde64daf69ce6f202838fed6ce36f656b4541e0
- MD5 c2c3ffd06709d4f7effa2ea650edab6c
- SHA1 ba564f311006d3212c0fecb0ec109bf50b00cbd7
- SHA512 36de83a82bc2b88a8f1fd78e32ca5fa4828128edc199ff3f0fd8a93249cf9ac13faba8a3fbab52ee4d807a74dc7164043f8d6df71eec6c0de9184e44a3fe5726
- SSDEEP 6144:RiO7BivAlibhrt59aNNihJePJpeDSbVvyXVkaHmEFfhb7RQhfw73Z5zaKW:UuABBLSoG3USbVvyzpb7RofwdBah
- TLSH
  T1F334AEA839261426C72FCFFE81D79419E13EF6B35F42665F28A70E114E123F4E64AE14
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral18
- Target
  XWorm 7.4/Plugins/HelixPath.dll
- Size 188KB
- SHA256 87003a78ca138348791d561b0d32437d3fa9c931b57e8465c01fcea5971c719e
- MD5 f978b1ff403bd512f932e462dc2bf046
- SHA1 01246056ee0c2b973d8c3eb75b54a2cf62ce9e6c
- SHA512 64161b1c2ddaf66eccce9097c0b6072e45c41bc969a77cc01bc9d476923e63d1a2b3e126060366300e55ac4f78eb26349d975228ea99f49ebc922253ec8c00be
- SSDEEP 3072:kRWo0y/6pTGIumoYEqFUAcfGg9DrZ0KJX4+Ov9LIlJ4F+b4Nk5kkJd3:QmxGIWQuDrZ0KJX4+Ov9LIl/bok5t
- TLSH
  T1FB146D7837122925EA2EAB3FC297B955D23EF3731342665F366F12514F021F0978AE18
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral19
- Target
  XWorm 7.4/Plugins/HydraWire.dll
- Size 412KB
- SHA256 da5495a72a8e014e4776f1aa3efe1628a687bb4aeda3d1c5c6bfcfa71cba6712
- MD5 b9d200144fe8f2e2733d73bb39063b8c
- SHA1 ddf3ad5e1a43d63782b9516582e153e8bc8b2c33
- SHA512 03d2d646cc9317710ad71079a2d928e2fdeeaa79df353d5cac9f398982c69f934d2ace72bb121a827a74aef20ace7a6fb1fb8f17b667257925429485eb0b90af
- SSDEEP 12288:s+F4pzICFS+MHpyipqEGzmESgYb4kpNzH/q4:saqIC7MJqE5jxjq4
- TLSH
  T14894C0ED29996923E77E873FD1934418E23F8AB25242576F2CA317408E477F19349E38
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral20
- Target
  XWorm 7.4/Plugins/ImpactWave.dll
- Size 249KB
- SHA256 587abdd08cb32e5c1780ced38a799ab50add04882fde7f7e32292406c79a8cb4
- MD5 b57ebde770c74a02b4abe4e20cd4cd65
- SHA1 8c58fcabc6c57f65ecdac9ae77b19328b36dc64b
- SHA512 41db5ddd8c51a192153de8699d4a30f75a046d6e7afd8c242b81e0b78189b843e6ae83f236e7bf6ac4a4d5f70c7c0d44c6cd1a50de1bb42a71c5b6e956c814aa
- SSDEEP 6144:i9sl/zi2ZLdNYWPrBrldTwD0QKCJsOdisM22lE89NFmGs2H8pey:Cye25lOPKCJa9N8Gs2cp
- TLSH
  T1BE44BEB42A655A32D76DCB3FC0CAAA29D13ECBB313835B5F186346654E025F4D78AF01
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral21
- Target
  XWorm 7.4/Plugins/JadeOrbit.dll
- Size 39KB
- SHA256 f38415db4e35f47611f8266a1b753c712ecd64b2f54e1cf29f7a9a61bfcf644f
- MD5 79c9ee6b7a72a7f7f75ac62b1d318a79
- SHA1 a467c1a66be06fbf6dc8f8b268c756633862d6e9
- SHA512 4d80347758b1a79b18fdba5082740703d9d1fe5e16334a51ca597448727104a4f7a72087c457dd64e0b6fc125f2df5b76769f633f236a245133b707c674c96a5
- SSDEEP 768:PofXMCBlQ6Kms0b6GE30Qs1YKtq9oQog1zqoPPz:PyXTa6NEBs1YKwo8fL
- TLSH
  T147032B4937FA0621F1FE0AF5C873A7289331F5935506D70E2AC9A0696B736C29610FE7
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral22
- Target
  XWorm 7.4/Plugins/KryptonKey.dll
- Size 207KB
- SHA256 ffc87b460d490e218769c72b46724b73ab6add0bc46236e5649acfcd46159c81
- MD5 d246bd4171bb18a6ef6c12446acbc641
- SHA1 fa7c5aa91089dc3616d30223a3a154f111763796
- SHA512 58e6e5f5ce19b2260343c27422aec21953cdd3056e083abaa127913929a34807478b4012ba57811d596f235f22b6e619655b0ebcc001a662a51f8819cb6707e2
- SSDEEP 6144:piHFPaCXRv34V9qspVlDUiQK98T2Rx0FZ8rjxQ5:zmzsprDUiNWrFZ8rjS
- TLSH
  T147248CB635959A26D71ECBBEC1C75C58E03EEA720E825B6F29631E104D133F0DA87E14
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral23
- Target
  XWorm 7.4/Plugins/LithiumLoop.dll
- Size 411KB
- SHA256 5c375193ca7074df4255f3ab43c796f69fb5938f44bddc0dbeeb6625f94c5c7d
- MD5 ef0ecc62b119c64dca88879473004743
- SHA1 da6008c1194f5c500737afb0abda2a9125896368
- SHA512 b3b188e2c0143c58f2724f55235ca494cf2a51943378c25e16d9dfec3bafd335f25af7e9313aa268f216075c8bbe7bde8540dfd7809f37b4c459b6d7d6f01d93
- SSDEEP 6144:YOGhT+dobK+lCMk/bvFVoGSqgmOG3Jg+/Mg+vwq8uRvi8UCPKaNT/2Wfkn+X:YO+f3Y/rAG5JyPquRvi8UGTVOR
- TLSH
  T19494CF693565AA27E7BAC63F82C75828E13FC97B5B43675F285302104F026F4D78AB1C
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

8^/10

adware persistence ransomware spyware
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral24
- Target
  XWorm 7.4/Plugins/MarrowShift.dll
- Size 679KB
- SHA256 16d6313caaab8d850895af6e8033aaabe65498e99a2faf3b49d2c084d7a34ce0
- MD5 e51c412c8df19249adb10b0cc8b39f88
- SHA1 f2e999d3e1d0218a6fe1215a1534049e40d97398
- SHA512 e50a511075998764512eee7133c001bb66c3a427a60084d90a6ab5acce650cbe5ee2211f580e0e684b7e8ca9d7e5d32b11c600d0adf3052023586ad61012140e
- SSDEEP 12288:JVnchrRTHcQ3nrn6xtI9qR5WKygA5KeirCDD/:JtJQ3nrnMI9MUnr5Kei+DD/
- TLSH
  T168E418203FE8E01FE4AE73B5D4E1972156B4E6427296FF8F258056E80E833886C555BF
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral25
- Target
  XWorm 7.4/Plugins/MetricShell.dll
- Size 209KB
- SHA256 42e299741caf374e3d5353dd4a6d199910c1ba5dbe5d65bf9225c80a4fa7dc0c
- MD5 565a00f87b9fc1373886735c47dea37e
- SHA1 808addc907e5c49cab6ecff23b993921d6b6539c
- SHA512 6af861e85762d5c9b3b977a2a2b10f9cca02f4c2fb8d0f9fca156dec5eb28c32fc44438cebc1b5abe5e31b2f0de4ec56c14c80638a82c5d855ba2c33845696c8
- SSDEEP 3072:kVGnG3dWfvCBiLiHcBcSkslSXOJ0E1i8qedf/UFAEQFDrgP0+gcZQN3GgY:GGnqA3mcBcSpUXINq2Dzhc2Nv
- TLSH
  T128247CE93B915522F66ECF3E81879849D13DCBB31783A67F24670A118E12AF0DA47F14
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

8^/10

adware persistence ransomware spyware
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral26
- Target
  XWorm 7.4/Plugins/NeonDrift.dll
- Size 196KB
- SHA256 ee0cbe0c92d40ad0c66ea044b2a38a186b61d0750562f6d9e48c5931e80b50d6
- MD5 c0598b044c569e821f8e0df40f3a25a0
- SHA1 c9eca47eab3f7be74b742e66ff3a3e30896ee075
- SHA512 5e321f165d9a8fb67b85b381056c2cd6bce7d65f718d2acdabb0c9403038c3e44d813098f27245e5c31321e50df051bb7557554b56191b57e981aa6b624ab842
- SSDEEP 3072:vH7BI8u/CnKYNul2b+5st7Eb42jJutmvNEQH9thWglbPqiKFfZhMPgVPfdS:vbBI8uMlZt7EzuwFxHhlYf
- TLSH
  T11414BE68B76819EDCE8E2DBE809443C78B7895A2DB1363EE199245B10CD53E40B61F1F
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

8^/10

adware persistence ransomware spyware
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral27
- Target
  XWorm 7.4/Plugins/NexusGrip.dll
- Size 213KB
- SHA256 205ccc49d98dfdc9f730bbcf80b2860c5d9381c5eca24b5dcb4a58f04b8fa4d7
- MD5 4f7528097772b02d77ac6db9ffaf8fe0
- SHA1 c88036efe1fdd9bc0a3d7035461e6fe695210262
- SHA512 324beb52e725c7fd6d95c80c817a5d7156d3d79eb8ae15215e8d702d35c7f478a36b08878ebac7dda2b9a34d1d9b7ff1ed3a4ad695aac52e6bf2ecae270ab361
- SSDEEP 6144:2s2SyFBsUEpUJ9tRhs+kr4GTYKmqfvRR2yGmhC:h29Fn9tRh8r47Kmqfv2yGmh
- TLSH
  T1CC248EFA399A5623CB3F9B3FC1879859D13DCBB31283665F25A706004D226F1DB4AE14
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral28
- Target
  XWorm 7.4/Plugins/NordicPeak.dll
- Size 1.4MB
- SHA256 9cda1851bae66258401866077c9bd6d8bce9abd9154372b59fed599ab8e5897b
- MD5 edc57af0dfef2bbb80d44e6199fdfc44
- SHA1 c5f7d26ca11da5c54a6ba01ac6d0a9891601eb97
- SHA512 3d7b64cd19de4a9b3e86385f5ee6cd14855bb9b15cf785d2ad2e91700210e9747587ffd2c8140bdff643a136a43f22556cd0fde84a596cb7b9f09df04f1f95f3
- SSDEEP 12288:evUk4Cz+x/KEth2wZtK1xLaFBFYguwEdIIFbV4sAKa+wEp8Ta1i/w/ME20:eP4rxKCYfKFOw3IFJ4cTp8TaM4/
- TLSH
  T1CC65838565429639FB8C1E732A05D70E492240AAA751BF090DD78D50B8E7FBE18CDCBF
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral29
- Target
  XWorm 7.4/Plugins/OrbitSift.dll
- Size 208KB
- SHA256 afe528a38eac589f13f26d1f350f7c87595e1baf02c4d6b2e2a5e908bc0ef174
- MD5 855db96880943ed44a6ac6ec58aaa514
- SHA1 449b1eaf597a0ad06c7dc6ac48382ded8bbe6829
- SHA512 ae133fde0785faa56a7c2e250943b9c17507369e3651cca5198bf2e9f329e648e5737806d4f80d30fc6584a86e4054b5e12752aac808f6ef58d497fbaeabe991
- SSDEEP 6144:2XVKIJ5A5aDsqZP2Tx3prFetG13Zv+yY:2nJ50agpZeo1pvlY
- TLSH
  T1FE249DE835155622DBBEC73EC2878887D23ECE77234256AF14E316505E06BF4E78AE14
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral30
- Target
  XWorm 7.4/Plugins/OxygenCloud.dll
- Size 88KB
- SHA256 66e18f8c94cc0938f99ad2a46494a331d3d0d5051f076dd75b81a429f8acde38
- MD5 2e196ca7f33a35d83b1d96775d306bd4
- SHA1 8320471565bd8a3ab1669669744e384833f5a51f
- SHA512 46a56fc89cff38b9021797730aa686cb91b5b29a3b0e899658fd06377c84e84202121c773f114432c535b41ea1012377234ff69e0d59441e84117595011b9442
- SSDEEP 1536:jIGHIpBFX4jm1RRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRROA4T/CE2rvhndgVah:kGGFX4DA4GXhndgcsV7sqBSZ
- TLSH
  T113931988A5F3CC67DA9C8DF70D63154E2D788C932112EE295BC7C2A5A7827D10B1E673
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral31
- Target
  XWorm 7.4/XWorm V7.4.exe
- Size 22.1MB
- SHA256 98f0a3fe8cedb340ace6bd1dcb57360d75e52b63074fb39cad09811da8ff4378
- MD5 69798950c9f217f0f1ac75264a7fea40
- SHA1 864b00372a97975c8c56bfe56d8837b52bc038a2
- SHA512 dcf3117d985086868e88ec9f972fd80edc9185c5334498bc32a88b09d389029190cde6053b0cbbfd8c509f1804c01ff5badc64bc84f75bf7aa5e84569cf64a15
- SSDEEP 393216:bdoTzMjoCm1w7UzfRVM1EOJOy0VM4Mas+M0HKefOd1p:bdyCmG7UM1ky0VM4MvbM+1p
- TLSH
  T15D379F64B4B4587C91627A3B05B2170A6B38BD1AD65E75F50E8FD00E20F23F4ED2D9B8
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

8^/10

adware persistence ransomware spyware
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral32

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Active Setup

T1547.014

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Active Setup

T1547.014

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

Resubmissions

Sharing

General

Malware Config

Extracted

Targets

Boot or Logon Autostart Execution: Active Setup

Enumerates connected drives

Boot or Logon Autostart Execution: Active Setup

Enumerates connected drives

Boot or Logon Autostart Execution: Active Setup

Enumerates connected drives

Boot or Logon Autostart Execution: Active Setup

Enumerates connected drives

Boot or Logon Autostart Execution: Active Setup

Enumerates connected drives

Boot or Logon Autostart Execution: Active Setup

Enumerates connected drives

Boot or Logon Autostart Execution: Active Setup

Enumerates connected drives

Boot or Logon Autostart Execution: Active Setup

Enumerates connected drives

Boot or Logon Autostart Execution: Active Setup

Enumerates connected drives

Boot or Logon Autostart Execution: Active Setup

Enumerates connected drives

Boot or Logon Autostart Execution: Active Setup

Enumerates connected drives

MITRE ATT&CK Enterprise v16

Tasks

static1

behavioral1

behavioral2

behavioral3

behavioral4

behavioral5

behavioral6

behavioral7

behavioral8

behavioral9

behavioral10

behavioral11

behavioral12

behavioral13

behavioral14

behavioral15

behavioral16

behavioral17

behavioral18

behavioral19

behavioral20

behavioral21

behavioral22

behavioral23

behavioral24

behavioral25

behavioral26

behavioral27

behavioral28

behavioral29

behavioral30

behavioral31

behavioral32