Extracted

Extracted

• • Target

    8c051812ef24f309b61efc25ec3dcbe2.exe

  • Size

    15KB

  • MD5

    8c051812ef24f309b61efc25ec3dcbe2

  • SHA1

    f0087d289a5cde7b3e691f5c40e3573ef2719b46

  • SHA256

    709901b9f87a31d0410d37973ecf94d76cca383dbcaf4402099080738caecfee

  • SHA512

    79df9c7693fa8e22093a201581922c1099c5d1aff822dfc2b9eba49f30ee5723a71a3f099ba6bdcfb8c3fa7d6c386a610957ce98354751043de2e9a7d5dbb7a8

  • SSDEEP

    384:u5MjRSSfunEq7uthXwQFk/3rhfewHwWAxW:cMVS8652XwQFkfrB4

  Score

  10^/10

  purecrypterdownloaderloaderxwormpersistencerattrojan

  • PureCrypter

    PureCrypter is a .NET malware loader first seen in early 2021.

    loaderdownloaderpurecrypter

  • Xworm

    Xworm is a remote access trojan written in C#.

    trojanratxworm

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Adds Run key to start application

    persistence

  • Legitimate hosting services abused for malware hosting/C2

  • Suspicious use of SetThreadContext

  behavioral1behavioral2