Extracted

• • Target

    SUITLOCK.exe

  • Size

    5.1MB

  • MD5

    6f9ba18a04ebf182900a0f4b94b3537d

  • SHA1

    15634a3aa0a59e8154ad1ffdb5eeb8387055f213

  • SHA256

    443da78d2f9696220afbc3d4705228f75d268bc6079162b2b020ec94f140a0b1

  • SHA512

    6bead3d7421afef0e1e8b060c10db34eec908c863f57264c25d6cbabbd5b9b118418cc34fef3f366927f97def4782c8499780e5c008a62b9f2fbcd9af8adb8de

  • SSDEEP

    98304:NNadRPPlP93efT/RehdEyiFr9/LSsTxy/rSbIixFid6fa:NaPPlPYf10i9TSsFyTSbIcFg6

  Score

  10^/10

  xwormexecutionrattrojanvmprotect

  • Detect Xworm Payload

  • Xworm

    Xworm is a remote access trojan written in C#.

    trojanratxworm

  • Command and Scripting Interpreter: PowerShell

    Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

    execution

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Drops startup file

  • Executes dropped EXE

  • Loads dropped DLL

  • VMProtect packed file

    Detects executables packed with VMProtect commercial packer.

    vmprotect

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Suspicious use of NtSetInformationThreadHideFromDebugger

  behavioral1behavioral2