Extracted

• • Target
    Nexus Release.rar
  • Size 33.1MB
  • SHA256 e6bd9b2b687e9a2381b43d1fabeca64e5ed727676b5b9470220252e4098a22b6
  • MD5 ebdab83af835d08bff846224db3f4083
  • SHA1 88ee2e0c51626b9263835591abdbaa494b7313c0
  • SHA512 4780d157e7883e604881685c55612ccb21b6a6e85a1cd2141e7a709348c9873dc16bddd04e2bf7cb66cb5458e56ba8b0dafcf8c2d80d5438283ad32acc3df446
  • SSDEEP 786432:t18J/dtaW3SYkjUjQZfeiQpFryUh5bQxou8MW:tu1tayB9QZFYsUHbQxoKW
  • MD5 SHA1 SHA512 SSDEEP

  Score

  10^/10

  xwormexecutionpersistencerattrojan

  • Detect Xworm Payload

  • Xworm

    Xworm is a remote access trojan written in C#.

    trojanratxworm

  • Command and Scripting Interpreter: PowerShell

    Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

    execution

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Drops startup file

  • Executes dropped EXE

  • Loads dropped DLL

  • Adds Run key to start application

    persistence

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  behavioral1behavioral2
• • Target
    Nexus Release/ByfronHook.dll
  • Size 21KB
  • SHA256 3811858da4b1f5e7f40d1237d7189ddca3989fa0d7b07e87c538f92975b893d2
  • MD5 4e3e92823caeac1203beaa5a35d6dafc
  • SHA1 893b591d46c39e817052cd05ec969fea74da4233
  • SHA512 0490e800f1e5c9b38b6c9b56616290f3a7214179e6d993214e3dd742d44d1d669fe5073b5a121c588c05f3e7c0ec576798236ee94e1a9b37e1d980d1969c9d33
  • SSDEEP 384:pPLl4JbDL8XQZW8LN/4pvuBUyHVz0Ad29DtSLKZR2CF/9+8ADu/TyZdEPLe:pPh4yQZW8LNuAUyJl29DtSLKZR2m9+8m
  • MD5 SHA1 SHA512 SSDEEP

  Score

  1^/10
  behavioral3behavioral4
• • Target
    Nexus Release/Nexus Release V1.5.exe
  • Size 33.1MB
  • SHA256 4763f3899de3f06d5598e165404dfb040d86961cb76c82fd153e9f8abff41712
  • MD5 44222f5b17b3cd5a6e0e9f3a8efce7ca
  • SHA1 3a7890ff8391ee849158ea1fa3fdd496ec00d3d7
  • SHA512 757da99975b8ce0efac615aea36d89811d0e3bdb47a94bd261ad28014d82c3d6d0b29ae9462240617fece6bc1686db4ef967faf51253488eccb827e7aa185307
  • SSDEEP 786432:mEpcxylSTtajAjj5Z2fQjcc54GqesS8sJpodQ+NWtPPAgnCaa:6WKjWO54GqesnssdQpwgnV
  • MD5 SHA1 SHA512 SSDEEP

  Score

  10^/10

  xwormexecutionpersistencerattrojan

  • Detect Xworm Payload

  • Xworm

    Xworm is a remote access trojan written in C#.

    trojanratxworm

  • Command and Scripting Interpreter: PowerShell

    Using powershell.exe command.

    execution

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Drops startup file

  • Executes dropped EXE

  • Loads dropped DLL

  • Adds Run key to start application

    persistence

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  behavioral5behavioral6
• • Target
    Nexus Release/assets.dll
  • Size 171KB
  • SHA256 672cb16128dea50e21fd2d98889e2d6a2264b654304a3f4248ebdf4c546f734a
  • MD5 bcc0b07de0a24f9701fc97d154ecd660
  • SHA1 cb5ba3b790cee940b4d18ff78e5a6cd71bdad47d
  • SHA512 18959767986401bc877d30416e550c55e97c158f674b8f76dc9af117494e65e11d6000521f72be93c193ebd38f84d1b9578386c24911fda97507277f06ebd8e4
  • SSDEEP 3072:rN505WN505WN505WN505WN505WN505WN505WN505WN505m:rNJNJNJNJNJNJNJNJNB
  • MD5 SHA1 SHA512 SSDEEP

  Score

  1^/10
  behavioral7behavioral8
• • Target
    Nexus Release/instructions.txt
  • Size 350B
  • SHA256 1795b27a75858a67a0c93bce21b77d6fd89213079ce4bb8aa09b1cca99be5619
  • MD5 8a23bcac9550c179f65025e505b4ea64
  • SHA1 d76ad057e81245e93a8934562b7b774643115893
  • SHA512 1708a67ed3fe59ad052dcb787979be15e91be283a6cd43c289924b2b83b55ade7a92a8e82649cf8ca89d229d66cd21c69b9cf353413df1b967a9cd443239e2bf
  • MD5 SHA1 SHA512

  Score

  1^/10
  behavioral10behavioral9
• • Target
    Nexus Release/license.txt
  • Size 6KB
  • SHA256 a19d58aaab15c4d0019e569d1c073d1b5286fdd37dbeee7a58a7d1ae76045ae1
  • MD5 0b09566254b011d989decf0e23a902eb
  • SHA1 3ae5cd6be73daf418b8deee9c865cf78225838c9
  • SHA512 4e22e58f925879306261e5993039e1d84d87f8fecc0f9fdad534da55b6fd22be77e622a4077d8d521f7734e5535f66853d581155987e2f3607e2d386938c218b
  • SSDEEP 192:uEwjuKsgA4+XYdXjA+okS63vZBCSUziJm:eNs8+QRVxBRU1
  • MD5 SHA1 SHA512 SSDEEP

  Score

  1^/10
  behavioral11behavioral12