Extracted

• • Target
    MasonClient.exe
  • Size 71KB
  • SHA256 d2b42973f51392acbcbf25fc6182557596af46aab973f9729d85bcb44f287e08
  • MD5 11ce7facb6a35f2f7961a4528b25b340
  • SHA1 934adc3f1be261e1e5e6e78d0d057126bad3c688
  • SHA512 8d707da6bdf770ea174a310ac56dba2125bee39072d3bb5ae348e1c2a3fa85032a8b1b8980cf64633ddd360363f360802c5e4f926fcc85ada2eec484433c1cc4
  • SSDEEP 1536:6OzbMNRzJVe4Jfaz3dod+OLCI9URE01E+Kv5fzk9dTVz1Z9EbR:tMR1Ve4Jiz3adzLCIUzifA3JZ9a
  • TLSH
    T1A363E0CFEBC8485FF9B90EF1987D711533D5BA000FA54DC958AE209C9D74B9AA901F88
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defense_evasionexecutiondonutloaderxwormloaderpersistencerattrojan

  • Detect Xworm Payload

  • Detects DonutLoader

    loader

  • Family: DonutLoader

    DonutLoader is a position-independent code that enables in-memory execution of VBScript, JScript, EXE, DLL files and dotNET assemblies.

    loaderdonutloader

  • Family: Xworm

    Xworm is a remote access trojan written in C#.

    trojanratxworm

  • Modifies visibility of hidden/system files in Explorer

    defense_evasion

  • Command and Scripting Interpreter: PowerShell

    Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

    execution

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Adds Run key to start application

    persistence
  behavioral1behavioral2