Extracted

• • Target
    Cam_Scann_13_10_2026.zip.vbs
  • Size 4.3MB
  • SHA256 9abab5bba27f0f089ba4bf0535456561031d4d941d78bfe23d480c3836642681
  • MD5 3d4bfcef8e65ad84d4c34290e5bea962
  • SHA1 cc9e8632af4f2d390795298bc65898637a45d15f
  • SHA512 5f532501578a68317d3e47e45dbaedf4fdfcb0944e5970c70281cb2b9afbb3d75ed0d224c92c4df4ed4d63ca2bc9ae0c44cfb6ec5ee3f794f94dc131f35e925e
  • SSDEEP 24576:dXkrLBl3c7d7YbfmkRcgZQblqi0Ihovpmw6ex0Ms+h4+M4G9v+KFM1CGz1oqoWNS:MLeMJm
  • TLSH
    T1FF269F516E5859F5EF8C690E90AEAF1D83F042176A33706BFB41DF04BE9A341864B21F
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defense_evasiondiscoveryexecutiondonutloaderxwormloaderpersistenceprivilege_escalationrattrojan

  • Detect Xworm Payload

  • Detects DonutLoader

    loader

  • Family: DonutLoader

    DonutLoader is a position-independent code that enables in-memory execution of VBScript, JScript, EXE, DLL files and dotNET assemblies.

    loaderdonutloader

  • Family: Xworm

    Xworm is a remote access trojan written in C#.

    trojanratxworm

  • Command and Scripting Interpreter: PowerShell

    Run Powershell and hide display window.

    execution

  • Command and Scripting Interpreter: PowerShell

    Using powershell.exe command.

    execution

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Creates a file in the Startup directory

    A file was written to a Windows startup folder. Files in these directories are executed automatically when a user logs on or an application initializes.

    persistenceprivilege_escalation

  • Executes dropped EXE

  • Adds Run key to start application

    persistence

  • Indicator Removal: File Deletion

    Adversaries may delete files left behind by the actions of their intrusion activity.

    defense_evasion

  • Executes a VBScript file via the Windows Script Host.

    execution
  behavioral1behavioral2