Extracted

Extracted

• • Target

    Files To Use.exe

  • Size

    493KB

  • MD5

    d110ec96448664160f10da4abd78152f

  • SHA1

    128cdfec7390922d3c643717149f81f4af277cd1

  • SHA256

    2fad8bf4e40ac2f1b7da870bb8e4c228bec5c52a875aadf347e71a9cba30d6bc

  • SHA512

    e99ca079cb44b89e331693c975438f88efda629d7fd898535c511078ca82e07be3faa71bcf31e0657f428556990860f0879d76e23c89f4d9be91f8655cb0734f

  • SSDEEP

    12288:PBdlwHRn+WlYV+9VeD09yIzj8ftZJIF+dHO:PBkVdlYATeDOyuj8VwFUHO

  Score

  10^/10

  umbralxwormpersistenceratstealertrojan

  • Detect Umbral payload

  • Detect Xworm Payload

  • Umbral

    Umbral stealer is an opensource moduler stealer written in C#.

    stealerumbral

  • Xworm

    Xworm is a remote access trojan written in C#.

    trojanratxworm

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Drops startup file

  • Executes dropped EXE

  • Loads dropped DLL

  • Adds Run key to start application

    persistence

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  behavioral1behavioral2