Extracted

• • Target
    2026-09-04_1abb7f3356e7be09cd16bf6404d6f051_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch
  • Size 5.8MB
  • SHA256 8dec58b9914d17ab8d4e1084d634ade7f043e97c235e28b3b1f7f3fc0e8cfd8e
  • MD5 1abb7f3356e7be09cd16bf6404d6f051
  • SHA1 9fc5ad864ad8091c9b5792bd409eb38cc19c8e8a
  • SHA512 12c31fbb0af68ca95f948ca712d54d0386327fed46e9aeca06a5d608ed87eb53c9d295a32755d5e5e08244e98a43b9159d9618b751cb133b8817bc00596214ff
  • SSDEEP 49152:DUNTvZSw52iWpkZ7JOMHWLNOc3RHCSJrQAlX1CcgVSV5AxkQrNKQK1K62GCq5Ea:DU5UQl4vDGji23gEa
  • TLSH
    T168564A07FC5554E9C0AED5348A729153BB317C881B3223D72B90F6292F76BE1ADB9390
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  adwaredefense_evasionexecutiondonutloaderxwormloaderpersistenceprivilege_escalationratspywaretrojan

  • Detect Xworm Payload

  • Detects DonutLoader

    loader

  • Family: DonutLoader

    DonutLoader is a position-independent code that enables in-memory execution of VBScript, JScript, EXE, DLL files and dotNET assemblies.

    loaderdonutloader

  • Family: Xworm

    Xworm is a remote access trojan written in C#.

    trojanratxworm

  • Detects Windows executables referencing non-Windows User-Agents

  • Creates a file in the Startup directory

    A file was written to a Windows startup folder. Files in these directories are executed automatically when a user logs on or an application initializes.

    persistenceprivilege_escalation

  • Executes dropped EXE

  • Adds Run key to start application

    persistence

  • Deobfuscate/Decode Files or Information

    Payload decoded via CertUtil.

    defense_evasion

  • Drops desktop.ini file(s)

  behavioral1behavioral2