Extracted

Extracted

• • Target

    HWID.exe

  • Size

    143KB

  • MD5

    216b93184fc784e9956b169983cf5af0

  • SHA1

    dc8a16b4c7823d60fcb0ea0ae1e3ffee940c74a3

  • SHA256

    486c1e6cf97c3466196e9657613be7abcbc81903ef91a70c3dc77e6c1f94bfd3

  • SHA512

    8b2afe6cdeeefd3e7e8c8a7b9328d555ede6699729b76c2900f2545fd871047ff34ccedc6612f17e77754eeca27244be16c5a2b44371a3d77e8d9965730c37b2

  • SSDEEP

    3072:Zc0MzJUdXr4Gg72hXaz5CojcYgaXr+LSLjj74Rp4p:Zc0E6do72hGCtYX+q4R6

  Score

  10^/10

  umbralxwormratstealertrojan

  • Detect Umbral payload

  • Detect Xworm Payload

  • Umbral

    Umbral stealer is an opensource moduler stealer written in C#.

    stealerumbral

  • Xworm

    Xworm is a remote access trojan written in C#.

    trojanratxworm

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Drops startup file

  • Executes dropped EXE

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  behavioral1

• • Target

    RC7/RC7.exe

  • Size

    160KB

  • MD5

    40e89aaf41d4ebda079572167d4665e7

  • SHA1

    c14a019a862aa3f595da7d15cc993f4f894d10a5

  • SHA256

    95388dfe045e7e976186c3ab0286ed8aa77bdb299c867f8c3e46f23ff7624a4d

  • SHA512

    035996ef789c0dc972265ec04652d01e1a530e61d4dfdd3fadc6e502a46b054e2b88fd5347d63deba491924b67c466996208f33f9a5019eb60923445551ce554

  • SSDEEP

    3072:Vjt4sK0uoEz8jh6oKyIPw+lV59i/XvGO0EFA0K+ymEN4NI:VjysKJ8cNP779Wvwc19yx

  Score

  10^/10

  umbralxwormratstealertrojan

  • Detect Umbral payload

  • Detect Xworm Payload

  • Umbral

    Umbral stealer is an opensource moduler stealer written in C#.

    stealerumbral

  • Xworm

    Xworm is a remote access trojan written in C#.

    trojanratxworm

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  behavioral2

• • Target

    RC7/RC7_UI.exe

  • Size

    826KB

  • MD5

    45d0009f95434cada8309d733fb511a7

  • SHA1

    446df53ed8df57635e7f4f9df5cdfcd3cabd340e

  • SHA256

    54a33b2d706978be99f68864b045445b61677213bfda6c5f9716fb0730fc423f

  • SHA512

    5850525d49c64e367d442e2815abe4560b802ef173b3f3f6c3897be5412a6e37d2214de2fd8a78158e7bc2583e5fbbf4f3b19d27630608267d06081c2c64763a

  • SSDEEP

    6144:obBtIJVLfsOIJVLfss8XnXwtQ/c72IkoxkDtSP4EIJVLfsw:oGVLfwVLfiBVLfd

  Score

  1^/10
  behavioral3

• • Target

    RC7/injector.dll

  • Size

    19KB

  • MD5

    a4db6b21f7398882100909f37c1067a4

  • SHA1

    7b2a61d09e4959f4578b556196a8405a2f6e45f3

  • SHA256

    d986554d185d3f4e827a1287322210ff6a143ed723d203efbf00a8757aa13714

  • SHA512

    42bafe3ef80a748db64dfc88a159a06ee33cecb3f709f01d9c1a9e38d3ab81008f3226963c1c2e926f5e4b6e9442fd2f8a89b0fa5425d04db869cf7be7bddd31

  • SSDEEP

    384:5xE24iKOgW7+uPOxQkWWma3NCx7cTuOJ9jIwq6Am:5JVKVxPXWWmgIx7cKOEZFm

  Score

  1^/10
  behavioral4

• • Target

    RC7/sxlib.dll

  • Size

    730KB

  • MD5

    9af2ced06e85829386be170da55b027b

  • SHA1

    2c88fc72d8a347e6fb59199262092c2d1d38afba

  • SHA256

    caee9ebe263b05fac66e27af5866b3d41e8c1325cfc90a82a0c977007a4a8a4d

  • SHA512

    81fd9c3346b375a2fcaa910c3934bff445c7a4a891dd956eaf91e6f92f5478699d1c271324f857ee18c4e626670a46073bddf98c511dc72a1a18d62cde92ee05

  • SSDEEP

    12288:dlGRjX5RpQm5k+Su/vP4FiN/LYrubSBz0pe7fEizVkaW2zNsn5z1F64sxM:EuU4picrPzOiRkaFNsno4EM

  Score

  1^/10
  behavioral5

• • Target

    RC7/vs/base/worker/workerMain.js

  • Size

    149KB

  • MD5

    27ead90c7702154755785e0e53398755

  • SHA1

    86b59485fe6f6ccb1805183fa75062a2ac1c859e

  • SHA256

    bdf9433692a08851e13dd58504eef19f51bd2ec7241923a68edf5772e0e53af5

  • SHA512

    6829681575179c90bb7817b17feee60e7d44d8abb15264ab39d7f0edf95dd1d030b99c12b005c753cd786c26ce6f17ff09b058c16f3363596f785e386ef78e82

  • SSDEEP

    1536:XNSxrkwnz+dTHHfvYYdBwDZ2Ogvh52xgh2hQXIvTBaB7hU74Yc6aphU1PblosJEl:XzdTagJkb+6jFlJJEt9yjjTCD2zw

  Score

  1^/10
  behavioral6

• • Target

    RC7/vs/basic-languages/bat/bat.js

  • Size

    2KB

  • MD5

    4cb475399c4490eea41982dcd6d9653e

  • SHA1

    fc97d57206ff7fa1c89ff0fc9f6e2f04a20ea185

  • SHA256

    9bca42394fe8922fec24b768eeb8ce04692de6fad82f9052d5b7e70f5c6b0f40

  • SHA512

    27eefe83cf38a7d784414d99b472f6fcd7e595691eb0f368254ba1f71aaf702840b62bf232c30c515a8fada234699fefeef496c0c24669cc158cb567227e4783

  Score

  1^/10
  behavioral7

• • Target

    RC7/vs/basic-languages/coffee/coffee.js

  • Size

    3KB

  • MD5

    9d0c4ac1691eed0a480c3e9246490d29

  • SHA1

    38258864fd070c35cec6b68715d58771df9fe3e1

  • SHA256

    e706c9f8e5c5a0cb01b2f4e4879ec34a050d6eb2a8840284eb7badd9d78099f9

  • SHA512

    437a703607a9f0cb96ffb56312d149b95f596290591d14098c36d978b2e1fdba3c3712c9099923bc0a709c5c0ebd7eea868f63dfbcc69cdf5a9325b8a67006b6

  Score

  1^/10
  behavioral8

• • Target

    RC7/vs/basic-languages/cpp/cpp.js

  • Size

    5KB

  • MD5

    0a16509e6cd0155fb622e785cfe976c7

  • SHA1

    7afa7f823191c43d7a4bdd7d91577495de62c21a

  • SHA256

    a7c2bea7ca3d9e203a3a286735945fe010c8f4f8d46620386ee8befc6a78b32b

  • SHA512

    2cbc48cb10c467561c6a84f59405e9c2f864640b3a21e6fe5cd14ad1a7ca5667b766b3c0511df26f28205dd17338a878bd1164a4f5875235a73214f3e4aeb49d

  • SSDEEP

    96:hFDMgRs/rbV1+gqVV1+/LVb9ZRC2seM6jjz13MwVcEghhb6Yw76wGcmvRBNIs:hZGrTOcVv5M61h8hSeiYL

  Score

  1^/10
  behavioral9

• • Target

    RC7/vs/basic-languages/csharp/csharp.js

  • Size

    4KB

  • MD5

    f8f841d13c9220e15dcd6bc386b37ba2

  • SHA1

    2b8b7003820d19ed83afde98c845db5e3d5753f8

  • SHA256

    6b3be9a86ee8e3202f51745d94d24cc1eefbcf7d9e6d94fbaf70146b084e835f

  • SHA512

    0b167865b8d7847792c80144e83bdf33655db6ecc0934bb3290f8b5793fee8168aeaf9d74b3541a9424c4f180aad496c2d8710e3847a5bf9d4b2c960ddea4ae5

  • SSDEEP

    96:hFDMgRsVx+rbV1+gqGV1+hmQuq1cBh8b7gj8/pLxb6J994wGcKU7dYIkI:hZi+rTtPsRXpw9SiKUJGI

  Score

  1^/10
  behavioral10

• • Target

    RC7/vs/basic-languages/csp/csp.js

  • Size

    1KB

  • MD5

    22ada25d590811dcff4e5f5d698e583b

  • SHA1

    c43d4846967d5037ef05b102e49d1fbc54e45fbc

  • SHA256

    4b5a5d7d50986b86b00833447e097c0f01a4388ce1765b48e7e371d06e3a4789

  • SHA512

    c8373ea0b78114f82e8bf027473f72ada0d8acd51623152a0072111d8b3b7d5ac310a1cc510c4e4cd2e97a7686db3c87b2da675fc910898bd11108e4b50ed189

  Score

  1^/10
  behavioral11

• • Target

    RC7/vs/basic-languages/css/css.js

  • Size

    4KB

  • MD5

    49ad30f1151cfd7a74677fdc6dd13da9

  • SHA1

    286d47f0a4cfa26da2e4d1f1317a8c87000bb5fc

  • SHA256

    bd331fd3bd2c37b0c3150035325f163ac9266bf6d942310764815e676d856d91

  • SHA512

    7337706bfd5bd54938da0fba35e97f8e5780491c04b58d43fc6d905bd2dca92897f1ed8d48e42665f166da7684cc6e29a63ae73f8d3779a9feb97c397a642f0d

  • SSDEEP

    96:hFDMgRsozIq+q17qcq6V1+/aMj1cqTroIrqjKf8O3lzXY0Jc:hZzzv9VmjoOf8O39XbJc

  Score

  1^/10
  behavioral12

• • Target

    RC7/vs/basic-languages/dockerfile/dockerfile.js

  • Size

    2KB

  • MD5

    e32de981bdaf75e6ffb8fe40bc955a68

  • SHA1

    bef1af7b26ea01c987c7a6295bb7192d83a32068

  • SHA256

    65b86fc54e9b35d6cb84f01dfb905680dbcad6605757de1d6bca84e3029889af

  • SHA512

    a3eadd8c1389dff6c2c6e595efff69be3a573d01e4e16b8e4a8b28f63e4c48c9c439b5dd93666d81d703d1c6b5bf927cc8e47d04af270128095f0d579407c2f4

  Score

  1^/10
  behavioral13

• • Target

    RC7/vs/basic-languages/fsharp/fsharp.js

  • Size

    3KB

  • MD5

    de122b3bc44a8714f386dc80282dcb12

  • SHA1

    06888a9b616993e9af9797cec64c6d419065f2cb

  • SHA256

    1390079babc117d3f376735780d98f409f317eb4628d17106642c6933ea1da7f

  • SHA512

    ab48f2e5bfa6ea0024530141bb5d35b9090ee0254a3e8f8b86fa36cc8c2fca8000a3caafcfffc1d83e21c488e1f1990c91f537290b54fbbca1d3c7be090dfba5

  Score

  1^/10
  behavioral14

• • Target

    RC7/vs/basic-languages/go/go.js

  • Size

    2KB

  • MD5

    5b4484c914cd97aff4510b803f2517ef

  • SHA1

    8f275ac36c57c4c464e30f92f525ffbd0fd436c6

  • SHA256

    46d1757c3cd3dbc3c7b465a338880144922a1c34c30e36f06ff2db8c2ff75b86

  • SHA512

    b34c64f9997f4b72760eca270d2a0c2e22d83467d3f0bc82e7c0e63d62d8f9d74a144a28d676a223cdefef417af723801ac0535375d0dd64bb3a81e87617fed0

  Score

  1^/10
  behavioral15

• • Target

    RC7/vs/basic-languages/handlebars/handlebars.js

  • Size

    6KB

  • MD5

    3ca7cf83292b56444548f2914c0e1811

  • SHA1

    4be5b1adaa187d82a94967e6960d811acd700b93

  • SHA256

    31d25588d120e7c79f3332ff3b3c794cebd0554c7578e3bb37b3cac366e4f6c2

  • SHA512

    2d337b64def0d42f8bd6476cf31e806f67f77d26c95c68e75574fc310f7974852a810f8b197238559a2cb20d07914de5844481477321cdcb2c68c47da9088eb8

  • SSDEEP

    96:hFDMgRspITV1+/I/+B1BerJzlWK2BZwIBTIwbcdg6EHpf4Og6E8S6g6EB+FpAjE3:hZhbYbQRld2BZ1O0p4OE60+dMZLDs

  Score

  1^/10
  behavioral16

• • Target

    RC7/vs/basic-languages/html/html.js

  • Size

    4KB

  • MD5

    630fa41f59a189aed68b4db82559de95

  • SHA1

    14a527d27240ba0effcfa43a5c46b9289e96b822

  • SHA256

    c717ac0701d3b1e22dc52a0c53608214297e5fab7bc7011cf4e964f2eca9d62f

  • SHA512

    e15c602788f13afd1e19e5f82de7a35eb9656950553bc3913205ba3e70ddf87199b7f9b358db7b7704efd3dc85029ad277692b6b84f5f549964b9dd7cce1ad60

  • SSDEEP

    96:hFDMgRsfInV1+/6mQVV1+HBwBRl0GSytHd6EHaK4T6Ef6EByyEhcKMgEQEJWf:hZLP+4+GLl0GSytHLaK4ccKM2

  Score

  1^/10
  behavioral17

• • Target

    RC7/vs/basic-languages/ini/ini.js

  • Size

    1KB

  • MD5

    b9252b74381fe17565d494711f4c9093

  • SHA1

    9ed6a00a166c0b5abdbb3ea45fa7df3a5defc8ee

  • SHA256

    1f0feeae58c32f6e1f31b78f7e2aab3c91da387e464234c0f55ebff0e77444a2

  • SHA512

    2fe594de8ac3444223edc011cbd7f08a6f8ab2de2bf56919c2d6f1208e22391652d14549c3822c21c4999139ffce711fdbf00725e95aa01068bf5f223c3b8710

  Score

  1^/10
  behavioral18

• • Target

    RC7/vs/basic-languages/java/java.js

  • Size

    3KB

  • MD5

    826546e08f178d68e8aa2ab29194c03a

  • SHA1

    444ed723cadc4231f2dce5c54597fa8558893d12

  • SHA256

    44be702cae05d5844dc1c452f9bd94020007b9e543a765db4e6649278607d218

  • SHA512

    8edb46eefaa3277374ba5dc656423115735573a57e82002745ce6112f666079d6ab7d9b5a79ed208ff51487e9ec2b757c45ec1b3c8119d8cbcd4f7cd30347ef9

  Score

  1^/10
  behavioral19

• • Target

    RC7/vs/basic-languages/less/less.js

  • Size

    4KB

  • MD5

    696ef3dca27b4f9313deba6f99710154

  • SHA1

    d3b377cae3355c3facbecc85bb342d4af34436ca

  • SHA256

    ed8d1a9da4e62d1cffe4c83580c9df57d688e850a45ace72c11bdeb064520a16

  • SHA512

    f9f65f8730fac803cb01d127c467359f428dbcc8e368f40a15fd56b7150b2258e9c581c3a35712ccc2fcde8a7108c89a33b80cb72721fea663a11a553657dc29

  • SSDEEP

    96:hFDMgRsR6rMq+q17qcq6V1+/v+ufj1cCzBbu/2nOgeJamEulIHrraW4NUa:hZE6rr9PuhlzBbu4OLaDuKqW4NUa

  Score

  1^/10
  behavioral20

• • Target

    RC7/vs/basic-languages/lua/lua.js

  • Size

    5KB

  • MD5

    8706d861294e09a1f2f7e63d19e5fcb7

  • SHA1

    fa5f4bdc6c2f1728f65c41fb5c539211a24b6f23

  • SHA256

    fc2d6fb52a524a56cd8ac53bfe4bad733f246e76dc73cbec4c61be32d282ac42

  • SHA512

    1f9297eb4392db612630f824069afdc9d49259aba6361fb0b87372123ada067bc27d10d0623dc1eb7494da55c82840c5521f6fef74c1ada3b0fd801755234f1f

  • SSDEEP

    96:SD3yDUfRD5dyVdO29SvE/TMCL8CvcOAtOfxSVkxMZlMfE:nD4Ldyn7Ss/TMmUtOfxhxjE

  Score

  1^/10
  behavioral21

• • Target

    RC7/vs/basic-languages/markdown/markdown.js

  • Size

    3KB

  • MD5

    caf4799639d5df40dfb1b979ed68af9c

  • SHA1

    6578ccc5111ddc190c354449be2630d91a21523b

  • SHA256

    eaaf453e0a9f9a604547e564a24e682503189cb9b85c87715bc9b5b6492b6f62

  • SHA512

    e787f3f849a40c608c3b35b732f16e4400c2d47e89ff309566afbc879fe37a7018722b959dc8ddc8c859d76e2f7bc0b85555cd27f7fc5e4d8e51e460ed32c9ca

  Score

  1^/10
  behavioral22

• • Target

    RC7/vs/basic-languages/msdax/msdax.js

  • Size

    5KB

  • MD5

    eaa7bff8662633aec211d57fd17cb8ce

  • SHA1

    3d783a13339a5797fa701165484bbdb70ffc0616

  • SHA256

    6ab13356e083c4334e93d3167bdd17d02552508bfd11ea044c880af3a1dd94f9

  • SHA512

    b3c5069dd3b8b56c0c945cd36909e2d7b575d3b804714b724b7f80bf03de1983a29e33dce050ff599017ece4ce22dce1f01bddda7ae2d41b25779455b96f4c00

  • SSDEEP

    96:hFDMgRsHrviqgq+q17qU/E18Qby0qbmofEsl93Bjy2rzR9sJDJOuz3O+PYLq+v6I:hZmrTY8Ey0UJfEI9z+zz3O+PYLZy4axE

  Score

  1^/10
  behavioral23

• • Target

    RC7/vs/basic-languages/mysql/mysql.js

  • Size

    14KB

  • MD5

    6482b3f16ca4f1436d5a5c9b54ab8956

  • SHA1

    bec1d967c0db6ca73cde65debd418f3e2c4db36c

  • SHA256

    7ba586bf9c623dc23f27a46e95a22342caa1f42d3b19fd9c018eb3b7298206dd

  • SHA512

    24b0dcb75254f4d69209d42bed81730c7c9ccac2230047a8fe46c81dab5a65618ce59be1b09100a1a2e42c515ea2a923a9c7084280bc567b2a6ee987cfb11039

  • SSDEEP

    384:hALxoDo1S36rNh/xkxnethQZZ62lANnY0k7N6AVzIAtSc2F9/0yW:SLxoDo1e4Nh/xNthQZZgNn67N6AVzIAp

  Score

  1^/10
  behavioral24

• • Target

    RC7/vs/basic-languages/objective-c/objective-c.js

  • Size

    2KB

  • MD5

    3ba48944ccda06514bf9723a2308b4c8

  • SHA1

    e9ebac91264e0510f8ff80710244c3ce56aee1b4

  • SHA256

    35af39baf166f7c2e3c95345b10ec46aa523f98783daa745aef64503019e3253

  • SHA512

    b8b1096188bf3837a696353988c4bd1b21f1cbde54a9ce8436f139765189c5dc8ffb02ad931a364d4780fb7fbb7dc18a600cc19a5db3e1a412f38d7269a24030

  Score

  1^/10
  behavioral25

• • Target

    RC7/vs/basic-languages/pgsql/pgsql.js

  • Size

    17KB

  • MD5

    7183810944428c812b3f9f4ed4adbb6d

  • SHA1

    5931e0e973678b836f548d11095b77398f7c38e5

  • SHA256

    a9487e85b74fd293c0131ae9bc181e72baecf5a0a6f8b71e97770d79332c09c0

  • SHA512

    a0eb6a021b24db38b98c7db1c5584bf190f789e5cb65fe13b7fb881fff1665cdaa7914556e0c0984f620b55b63a7b9f7902b706d596b2603e8720dc85dfa185f

  • SSDEEP

    384:hhLx5HtCBHHfrxrOmYbatR9uwX6l+qCVFQBTI7e9/asW:PLx5HtCBHHfrxrOmGaZKgKBTIuisW

  Score

  1^/10
  behavioral26