Extracted

• • Target
    2026-09-18_9aeb63e2e74c2c670db94c872e87b40a_cobalt-strike_cryptbot_icedid_njrat_remcos_satacom_vidar
  • Size 1.5MB
  • SHA256 788d64d1d4c905bc93b307018bf80ff2abebbef57026620484eab4baf954d01e
  • MD5 9aeb63e2e74c2c670db94c872e87b40a
  • SHA1 243ff7c7e05401bb37299e047de07ef1917ef25f
  • SHA512 6223d33e6c472c1add2845c1fbfc3dcd512d7479b91eb1b216a7cd422c24c37758f6673034536cfa90495e4deadaeeec45c12daa7a815d5432222e4aa9795c7c
  • SSDEEP 24576:xuDXTIGaPhEYzUzA0/0IJ5ABqA5Z+Udn4m3Qt0ATXudCdCHeLXgEXvpyCcoF5Z2S:kDjlabwz9RKqAnV13Q2ATsgQeLHPF2Kj
  • TLSH
    T165750109F7D809F8E0B7E5388A768A02E77A7C4A43719A8F1365515F1F27790DE3A321
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  donutloaderxwormloaderpersistencerattrojan

  • Detect Xworm Payload

  • Detects DonutLoader

    loader

  • Family: DonutLoader

    DonutLoader is a position-independent code that enables in-memory execution of VBScript, JScript, EXE, DLL files and dotNET assemblies.

    loaderdonutloader

  • Family: Xworm

    Xworm is a remote access trojan written in C#.

    trojanratxworm

  • Detects Windows executables referencing non-Windows User-Agents

  • Boot or Logon Autostart Execution: Active Setup

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

    persistence

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Adds Run key to start application

    persistence

  • Enumerates connected drives

    Attempts to read the root path of hard drives other than the default C: drive.

  behavioral1behavioral2