Extracted

• • Target
    Stake-Casino-predictorV5.3.zip
  • Size 263KB
  • SHA256 cdde0a99b6eb34272e471e7d68c7e201892d06f4bcec7254c1a60e89daf3a22c
  • MD5 e819ffd0d9db7f6d3966bba89ab3f62a
  • SHA1 3882871a41c1faae96f802393a0e447511973775
  • SHA512 bc308b3d921840f57a957d4ded1517ba1246011263e04cbf4093a526a4edc0239a6bbfd3c454bac42654c36932c02a8bd29a12f2504775337e5ae9c48b71f5ea
  • SSDEEP 6144:u/rtx3s5vmjxa5l6VIteAg19wc8GV9PP/UMSNxC7AXWI:GzWvmdaPsIEAA9UGV9PPWN8EmI
  • MD5 SHA1 SHA512 SSDEEP

  Score

  1^/10
  behavioral1behavioral2
• • Target
    Stake-Casino-predictorV5.3/Data/driver.dll
  • Size 267KB
  • SHA256 232ff2bec97a61d7efe72df1e64e397da5a2091b694930f02db0bdf0dabef9b7
  • MD5 c7489479e3959c074892fab7e3ccb78c
  • SHA1 fa1491e22997924ca0cf9fcab7be03a2db5c32e8
  • SHA512 99732c64853e7d14febdbeee14a3b06480ae485993fc9e487945ab1b55b006666702b96ef607e4bf6267d465a8253a2b3a6553ed0ddfbbb954fab966142d25e2
  • SSDEEP 6144:9kQv0JoOdXsIpMQTC5aGeHhQT4yiZz0WxqNl6tvvI/Vd4NuPnIWPCR:5vAXTpMQTC52QMyiZzlqNlQnKd4NuwWY
  • MD5 SHA1 SHA512 SSDEEP

  Score

  1^/10
  behavioral3behavioral4
• • Target
    Stake-Casino-predictorV5.3/Data/render.data
  • Size 47KB
  • SHA256 e4118e2e86859a25ac4bccb4fb6c95a45c07f0bbe44621eb0228ffe40fd016e3
  • MD5 014f79448a036eefcfb2065dcad0d51c
  • SHA1 4ca8959526dc949edac260439b4a59144fbd8162
  • SHA512 b57603eeb9d0271b8f38d8a735b98decb4ae01b1f2835bc2b9026780d9ec617e3e8d6ba7398528520b5793deda2d675207de44b774be6d077d2952483b766358
  • SSDEEP 768:6ODhaH7s4p5Yy4DN9UusKjQbXBgscI6BWNztYcFA/Vc6K:65CJ9UxKjkxgscI6ENj8Vcl
  • MD5 SHA1 SHA512 SSDEEP

  Score

  1^/10
  behavioral5behavioral6
• • Target
    Stake-Casino-predictorV5.3/Stake-Casino-predictor.exe
  • Size 54KB
  • SHA256 07f16c8bb008d15f80f4fef741996919ac162de9cc812d241d9d9c3d9b067acd
  • MD5 4f73159bd26afdc777d1b1da422bc12a
  • SHA1 f364d97a10464184d2e5916f27047888b9515ea1
  • SHA512 b968627bdfbf29f07049030373322952a4b9e4ce9b1b15bb0cd2b5513582e07388c8b3f07c8032b89d5aee436d5e1a948706753f83218c7184a699dacd6c60cc
  • SSDEEP 768:GQbC0Dhax7s4p5Yy4DN9UusKjQbXBgscI6BWMQtYcF2l1x6KPFn6f4KE:hbCdCJ9UxKjkxgscI6EM821xlPFn6AKE
  • MD5 SHA1 SHA512 SSDEEP

  Score

  10^/10

  xwormexecutionrattrojan

  • Detect Xworm Payload

  • Xworm

    Xworm is a remote access trojan written in C#.

    trojanratxworm

  • Blocklisted process makes network request

  • Command and Scripting Interpreter: PowerShell

    Run Powershell and hide display window.

    execution

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Drops file in System32 directory

  behavioral7behavioral8