General
-
Target
GT Proxy.exe
-
Size
310KB
-
Sample
240526-p71aasef3x
-
MD5
85cfe597bd2fb4ea20e68f83f47b7df4
-
SHA1
4ab1dea0fadc87022dab356b02a759f72ec30c2d
-
SHA256
4735fa85ee766193771be94023eabf93f7763ab742cdd0c0bf5a84e36bcaef3a
-
SHA512
44087253b541b64a43eb60051420a8f25cfc571eb0e357864cce50a44ab709f7eb27d9054444dacd32645d0b4a7b53f25003b30c9452e079921be154d89a859f
-
SSDEEP
6144:LWP91UbeeC+5r6PmRIoS5P7xVEDc7SuDSSwb:Lw8CB9V5b
Behavioral task
behavioral1
Sample
GT Proxy.exe
Resource
win7-20240221-en
Malware Config
Extracted
xenorat
149.0.26.4
Growtopia_4232
-
delay
5000
-
install_path
appdata
-
port
4444
-
startup_name
nothingset
Targets
-
-
Target
GT Proxy.exe
-
Size
310KB
-
MD5
85cfe597bd2fb4ea20e68f83f47b7df4
-
SHA1
4ab1dea0fadc87022dab356b02a759f72ec30c2d
-
SHA256
4735fa85ee766193771be94023eabf93f7763ab742cdd0c0bf5a84e36bcaef3a
-
SHA512
44087253b541b64a43eb60051420a8f25cfc571eb0e357864cce50a44ab709f7eb27d9054444dacd32645d0b4a7b53f25003b30c9452e079921be154d89a859f
-
SSDEEP
6144:LWP91UbeeC+5r6PmRIoS5P7xVEDc7SuDSSwb:Lw8CB9V5b
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Executes dropped EXE
-
Loads dropped DLL
-