donutloader | ca8ac172732a3436fc75e40cbdead160fb8af54746ab86243a0fbc1ac019693c

Sharing

Copy URL Twitter E-mail

General

Target
XWorm V7.4.rar
Size 93.4MB
Sample260824-x5srfasfmd
SHA256 ca8ac172732a3436fc75e40cbdead160fb8af54746ab86243a0fbc1ac019693c
MD5 a2e5f3116a7ecd4512a446b263cd27cc
SHA1 fc71ecc561ef8cf39828caf344113af599219f2b
SHA512 d5261683fc540e9e508bcc333baa316c6af6377e8fb01f44f4049b55b92f09f64a990253a4f709eb77ff79b519ed10522bdf97249a63568f1a639e6bb1e348f9
SSDEEP 1572864:VM/DWgR6SoqYb3GrUWSfukf9yKd5iOZFUakmHcp7UxDFiOOa8ELieXXvfEDvG:u/jXoqYbsyRVjzaRJhYDkvPeXXvfE7G
TLSH
T1462833D70EB307328DA419832B190DA33A3FF6419D6838491E5B7A7B85EB141EB835DD
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Targets

- Target
  XWorm V7.4 src b2y mac & psycho/اكسوورم كلين 7.4/MySql.Data.dll
- Size 1.1MB
- SHA256 b9974ec9c4b5453b6a00f2235edcfdcaaad931928c35faf8aac0bb57ef69d782
- MD5 94e00465e44f5782938e27df2dc7362e
- SHA1 2970ceef0c1e6cfe3b8714c428c8857c7b157ca7
- SHA512 25cd34b4ff0e2fe9905f836240aeeeb3202c62a9604c46ae4535016cbad43a31389b9ef11b2f6836ec5f458114aca97a1c63edbf9d598a24f35c7ab6be763e20
- SSDEEP 24576:Y/G6E9m5a3wZC7FuuDqUDcEepg7kiOKTt:9qgVLcEepKuK
- TLSH
  T103456C0037F9EA29D6DF9679E77596184BF1E905B102F75F1208E5A92C33B408E40BB7
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral1 behavioral2
- Target
  XWorm V7.4 src b2y mac & psycho/اكسوورم كلين 7.4/NAudio.dll
- Size 502KB
- SHA256 81b3f1dc3f1eac9762b8a292751a44b64b87d0d4c3982debfdd2621012186451
- MD5 3b87d1363a45ce9368e9baec32c69466
- SHA1 70a9f4df01d17060ec17df9528fca7026cc42935
- SHA512 1f07d3b041763b4bc31f6bd7b181deb8d34ff66ec666193932ffc460371adbcd4451483a99009b9b0b71f3864ed5c15c6c3b3777fabeb76f9918c726c35eb7d7
- SSDEEP 6144:96/i10SZtfzWctj98vZcE0wmLlaIZs5eku2sX2hrjAzvgmXa6W9FwsT9idwktQZG:9yrSKMJR9aGs55T1X9Fwspi2tGpmS
- TLSH
  T156B45C2237E4962BD1AF5775E4E1191B8BB1F8423237D78F8684BB6E1D837924C407A3
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral3 behavioral4
- Target
  XWorm V7.4 src b2y mac & psycho/اكسوورم كلين 7.4/Newtonsoft.Json.dll
- Size 695KB
- SHA256 e1e27af7b07eeedf5ce71a9255f0422816a6fc5849a483c6714e1b472044fa9d
- MD5 195ffb7167db3219b217c4fd439eedd6
- SHA1 1e76e6099570ede620b76ed47cf8d03a936d49f8
- SHA512 56eb7f070929b239642dab729537dde2c2287bdb852ad9e80b5358c74b14bc2b2dded910d0e3b6304ea27eb587e5f19db0a92e1cbae6a70fb20b4ef05057e4ac
- SSDEEP 12288:GBja5bBvR8Q0TE2HB0WLmvXbsVG1Gw03RzxNHgKhwFBkjSHXP36RMGy1NqTUO:GBjk38WuBcAbwoA/BkjSHXP36RMG/
- TLSH
  T166E4394123F98F2BE1AF6B75B4704E1543F9F917A6B5E78F9A04D9A91C43B408E403A3
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral5 behavioral6
- Target
  XWorm V7.4 src b2y mac & psycho/اكسوورم كلين 7.4/Plugins/ApexLogic.dll
- Size 1.4MB
- SHA256 3b2630e3433dd2d50df05f6743f8c5bf4be0aaaefd0b7e1cd2cae92cbf024830
- MD5 86d9a66323a7ecae53bd8a41dd76c174
- SHA1 13027c2fe9ae978bbc3b0911e4db1695a648ddbf
- SHA512 fbb7ff523b470629ebcd02f6d389f621999030fad28fbabb8e5b503d4f7b43b256d92028986e5cdedbce8027446435eb9a51a14101e98b16f2032f262692c876
- SSDEEP 24576:QLIrdj6cRIwi3etcihIXvcQizAaUkEVGEEofvStLue+Zi:7Jj6eOGcb0QgAa1EVGEh3gAi
- TLSH
  T1226512B9381BAA2BC764C73FC1D65829F13E94B391C26B6F249387104F026E9D7C6719
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral7 behavioral8
- Target
  XWorm V7.4 src b2y mac & psycho/اكسوورم كلين 7.4/Plugins/AuraNode.dll
- Size 220KB
- SHA256 7bafd173a30e599d670b91427b7d24795143f0d77c09dd6c9fca13af150a4c6f
- MD5 d84f14824405bbb10da2bb126965cb8a
- SHA1 7daf80b867b8c132ff6fd8893444548dad070cc9
- SHA512 97c63fcbe72f9f07953604b0905146d4c19678b1fdd50827d2c6469e27e0c66defafe2cad6b035c11d80f740f383121b95b255c5be6125e13c58f6c739365318
- SSDEEP 6144:uAVH9ZtyXefRYiXMhAOw0zBii/0dSw6l:uAJQXe6ic6Ow0zBii0dSw6l
- TLSH
  T137249EA43A566632EB2E8B3FC093780DD13EF7731383979F295706454E166F2978AE04
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral10 behavioral9
- Target
  XWorm V7.4 src b2y mac & psycho/اكسوورم كلين 7.4/Plugins/BerylSync.dll
- Size 263KB
- SHA256 2a01b2d43c5cba2b14fec1e59f1651aa30febc558e5b23e2c9d99df2e9f53e7f
- MD5 555682b2e3844000d46db1939ed17422
- SHA1 2516555f1028474a0cafc569fa3ab91c29acbfe0
- SHA512 5986b4c093f3f70b78878b59b46ad49b972e37c33de9ffe7257fc2f68d40e994a47ca04a4c3b21e5bed8e2ee12440726a816359ceda3828023129971b8b9fe4b
- SSDEEP 3072:Bs/ztWljPmg6tpgx4yDKNLEaX9Sg3LZ3j2kMZZbJVBVrLBctDUP0TPFBEZRt:G/R2PmaxMdX9NxjnMZZ7Pow0TF
- TLSH
  T1AE44AEAB3456566AC76DD73EC2EB9829E13ECA771F43675F289317108D026F0D78AE00
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral11 behavioral12
- Target
  XWorm V7.4 src b2y mac & psycho/اكسوورم كلين 7.4/Plugins/CinderFlow.dll
- Size 440KB
- SHA256 f370cc92d6e2ccbc519ff560030d3f14183f3a3d6904d2200bfc592d52b8149b
- MD5 54102735721a2b52fa0495c265bd4f7a
- SHA1 8b5a4fc3ee86d236e602b595be42dae56018ccc3
- SHA512 44c4f5a894c49db391533571eecd525e033fcc19ce8d3674c2e761a48fc6bffa4cce4ecec12fce075b9406ab59b5d32e7e440084e6124f789256d8a9b132abb0
- SSDEEP 12288:O/jpw3TuuSvxojZ81WaQZvT7lRBkd9+zvWE:O/Gjulqjq1WfZ7A
- TLSH
  T1C1A4D0F635625A23C72ECBBEA2C35C19E03EDF7326821A5F189366008C427F5D787A15
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral13 behavioral14
- Target
  XWorm V7.4 src b2y mac & psycho/اكسوورم كلين 7.4/Plugins/CipherLink.dll
- Size 2.3MB
- SHA256 9a71ea7367b53600b8579599d762766849e1e6750a2f05c8ab2030d6cdf78b30
- MD5 8370d4046a02221979a8ec114814df25
- SHA1 37dfc83d0b49bd7a196f97e8fd0bfae8eb8285cd
- SHA512 991e8511cdbc7bee6d4493f7f21bbcd882b3b5a5e579a266d304aedfeca82378b0fbd886729bf15a8c3c7ec8ec0e0da02510b132d9ae1fbb8198fa1e609aa96d
- SSDEEP 49152:OxU+gkeZAyUPrHeh07ThlBUh7//4u77cIAUH4c+OSupJL:OxM2Lq//Rfcnc9x
- TLSH
  T157B50105A7E885EBF1BB93B8C8A28441C7B1BC059775DBCF2B4019EA2E177908D35763
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral15 behavioral16
- Target
  XWorm V7.4 src b2y mac & psycho/اكسوورم كلين 7.4/Plugins/CosmosEdge.dll
- Size 228KB
- SHA256 88b08e71e67f0f4610e96e667d4b7f331ea5aa5372f13fbcabbbbbb41ffde73a
- MD5 efbac3eecc4a904fe0fa77074a4ac441
- SHA1 2793230d9bab508888736ff8a89d0256805c04ea
- SHA512 1e628b12d6005698b2c3a06bc9421e91847b1a2a039e7e02afa89a963f6a27edee15959b26c69257c8c7a897fb487615f47fab53afc4ff9efb0f4a314140fcb8
- SSDEEP 6144:xLEMzYxiN+0bMOAyiVKT3Q+85WMuQw3pl9Z:xLjXMKiVKT3QFjuQw3pln
- TLSH
  T10D34AEF739651923C72EAF3F81A34925F13D8A7B4B039AAF18D706144D566F0EB86E00
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral17 behavioral18
- Target
  XWorm V7.4 src b2y mac & psycho/اكسوورم كلين 7.4/Plugins/CrypticPulse.dll
- Size 1.8MB
- SHA256 000cfccf2026b977748dc32e9c4ae8e5cb6e726ecf2554598ad44464e91cb6be
- MD5 0c95aa98ee51260d0c419ba134f6ee20
- SHA1 cf850d7b6f44a21586484fda52deef2c8f42deda
- SHA512 b823c8fa228f9fd073fdd1a9c12ab01821e28eab12737823c72293884970b5472c01bf4e5e1cd7154d7b1b5cbbb691cad554a5c73464f05f95b88bf87c12f594
- SSDEEP 24576:8cCs4uvW4jfb2K90oo+C8JwUZc0PY0yNuVC9Hbv50eFGPlfDp6XssJxSPH:8H7uRfbQswUZcSByYGv5uZEdSv
- TLSH
  T1D0959D12B7D6D1BED1AE40B98A774919E2B1B8405B25CBC79AEC133D1F233E05D3A316
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral19 behavioral20
- Target
  XWorm V7.4 src b2y mac & psycho/اكسوورم كلين 7.4/Plugins/DaggerPoint.dll
- Size 367KB
- SHA256 5ec512b958e6884d4586e331d13eaec6fc64bca53886f89340b8edfe8b37e26d
- MD5 30b444e0ebc7f3a5764b12af74a9a2c2
- SHA1 9a1f87e8fefb56def66c7faab58c118412243607
- SHA512 5417f1400252f565fd76b54b27abfbfff173b6824b1e8fb92da68b8c9bedd33632a9b713f0df527af283cbc31b127a53e821817c3171f7b68b9e5420d3a58943
- SSDEEP 6144:v3KIHG5oKl37LtfSyUemqexCwpvZeyajh2dZ21PSwqDS8hl7rCZFo2xX:yJnft1tTuCTyat2dZoqDS8hlvCZFo2
- TLSH
  T1E184DFA8393955B7D62EE73FC0C39465D13E92F32243AAAF246362304D125F4CB97E16
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral21 behavioral22
- Target
  XWorm V7.4 src b2y mac & psycho/اكسوورم كلين 7.4/Plugins/DivineMesh.dll
- Size 83KB
- SHA256 680ec3a3e7a90dfedc1e572e25cc1a17a1782e882005d88e53db9965136b81b1
- MD5 ff94c16016c40e70013db9321ffe9926
- SHA1 60e11f4def0fe9459f5d0ee87059621870964867
- SHA512 8040180f232ccbaaae36384c959592bb23000587dda454c9646cb748ce639b6c046edb061919060d7b961a061997905d91076116b1d0152961bdd7ac86a58c8a
- SSDEEP 1536:qPJayHUz3L54RRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRDCHZO7iJK8NWI9I1k:Op07wC5O7BI9IQmMGyNz
- TLSH
  T1E38329C496F3C566D6C86AF711937E1A2674418731C2FB220BD7C998EE87AC15AC3873
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral23 behavioral24
- Target
  XWorm V7.4 src b2y mac & psycho/اكسوورم كلين 7.4/Plugins/EonVault.dll
- Size 1.6MB
- SHA256 068008c26dd532a06e14394ec3a31917906c797582ca9d7c7bedf41a12740b09
- MD5 0815539e99c6af573e16cbc0ff402342
- SHA1 7917994c52fb898e865e1f93b64c67e350fe47e8
- SHA512 1823330ca717b797f6a266d5b92937d0baba2ffca5ba40a0b2715557b64f48b0063d6cca54a8d1a7e8bee12aca90f624ae26383b7a50d856baf05ed283266f76
- SSDEEP 24576:TCs4uvW4jfb2K90oo+C8JwUZc0PY0yNuVC9Hbv50eFGPlf:+7uRfbQswUZcSByYGv5u
- TLSH
  T10A759F62B69AC1BAD4EE80B9897B961EF7B6784407348BD712D4172E1F337E01E39311
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral25 behavioral26
- Target
  XWorm V7.4 src b2y mac & psycho/اكسوورم كلين 7.4/Plugins/EtherNet.dll
- Size 14.3MB
- SHA256 351d24433567b9ea704c2e4a884807752aee0eb513bf45dc7e0bc678a57c9f54
- MD5 8e1ff68af99336ba3faedc518dfc0d52
- SHA1 e434dd76b40b721a6e1dc690e7fdd8a90b5d20aa
- SHA512 1ea22a94e86f6013eb947f3e0af88caf783c2a493dfd68b24fc4d3acf2cbd91f217a3d21ccd192b82170b472cd2bada2393f7a7cd166783afc16ea1c3940856e
- SSDEEP 393216:i2HsIHU9aAPwDbbpNGKSWpyCH/5/bxY4H:i2TyobtwYp3FH
- TLSH
  T114E6237C74D4E8B3DBE601B68D6022F2A63EBC17F7C1B4B9984E871049273E9ED21456
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral27 behavioral28
- Target
  XWorm V7.4 src b2y mac & psycho/اكسوورم كلين 7.4/Plugins/FalconScope.dll
- Size 2.5MB
- SHA256 89dd2e64dcec3143d5dc4674b05c3fc91fe16ae62569396994f9c402160b7249
- MD5 e28e7b320648f887f69410816682685a
- SHA1 c16ad409d23467396076e5531d7c9a6ed050785c
- SHA512 e66af234ad1e242d278a06fb05f0dd54fb33d1da7dc2ad6a80673890f470f2d62832d488e46e4ce9282705489fab42e311360ffb19cce1b2f780e617b2b7abeb
- SSDEEP 24576:B6jLLWCs4uvW4jfb2K90oo+C8JwUZc0PY0yNuVC9Hbv50eFGPlfje7eelX6jTQa8:B6jnt7uRfbQswUZcSByYGv5uZseNpG
- TLSH
  T12FC56C4162C5AEAFD76C01B5B6A29A0493B5F4845B23FBC7569E237C1F2B3E00D76321
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral29 behavioral30
- Target
  XWorm V7.4 src b2y mac & psycho/اكسوورم كلين 7.4/Plugins/FeralCore.dll
- Size 252KB
- SHA256 5b95c28895caa93432b74252cdeddb35f687a19f85b52613fb617ada2e847717
- MD5 f083da4d26fa99cd36c81a2b7775597e
- SHA1 5cefdb89edde28e52c644756534a3217f21c5fc2
- SHA512 c9c5684d10baa47fcbb7a279e1c9e192abce54f1fd1934d04644d2f5a35657db7b92fac0bcfbab567acdb877c7f5373b8ecc3fb7f643711bb75ef85bb5928d5e
- SSDEEP 6144:2F/sQ08FH0Q9kaHEODGVxcdF61lpLm4XtH15w:RGH0Q2aHXCxe6h
- TLSH
  T13A449E7935295922D7EEC73FC28AA899D13FDAB31342676F18A326103E429F19747F04
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral31 behavioral32

MITRE ATT&CK Matrix

Tasks

Sharing

General

Malware Config

Targets

MITRE ATT&CK Matrix

Tasks

static1

behavioral1

behavioral2

behavioral3

behavioral4

behavioral5

behavioral6

behavioral7

behavioral8

behavioral9

behavioral10

behavioral11

behavioral12

behavioral13

behavioral14

behavioral15

behavioral16

behavioral17

behavioral18

behavioral19

behavioral20

behavioral21

behavioral22

behavioral23

behavioral24

behavioral25

behavioral26

behavioral27

behavioral28

behavioral29

behavioral30

behavioral31

behavioral32