Extracted

• • Target

    cheat.exe

  • Size

    61KB

  • MD5

    427cae9ddc40f9a7ea51459fc265d9be

  • SHA1

    8c68b6be3529637908878e64a020dd99c3bf98ad

  • SHA256

    4a1a9976a6fc9351ce34db0c601952328f52b526894cea614b51879c065e89a4

  • SHA512

    da5d985814986580a53712df240dad2dd876a16aeebab7e89ddc9968a8d2305dbf1cb695e1fa812ac534f27f1dfabf1be8aedac1f07d1b311163843f905a47a1

  • SSDEEP

    1536:SAXBcwCcPCxLgk2BeVbcqbhc48Ulk36nJNOOKLj:SAyvcPCaJe9Pbhc0hcOKLj

  Score

  10^/10

  xwormexecutionpersistencerattrojan

  • Detect Xworm Payload

  • Xworm

    Xworm is a remote access trojan written in C#.

    trojanratxworm

  • Command and Scripting Interpreter: PowerShell

    Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

    execution

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Drops startup file

  • Adds Run key to start application

    persistence

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  behavioral1

• • Target

    out.upx

  • Size

    653KB

  • MD5

    6970ea0b6597dcd5b4f5f19f28e958a8

  • SHA1

    a0130bb7ac03ec4799c90781ca93fd1392c6d54c

  • SHA256

    481e03978ca339ce697252895efe89b09fefd3098ad247d24eeb6cca9969f553

  • SHA512

    bc95cbe9a050e3d3b713745ef399bf2817d38f8e019f6edffdd2bf755badbde766e434e39a7f32356125bba0692b694c18da8dd0762aac0c9430d45acb215e01

  • SSDEEP

    12288:nkxDoouVA2nxKkhEvdRgQriDJOIlW+yBGQowlNCWS:RRmJkioQrilOIc+yMx

  Score

  1^/10
  behavioral2

• • Target

    loader.exe

  • Size

    61KB

  • MD5

    427cae9ddc40f9a7ea51459fc265d9be

  • SHA1

    8c68b6be3529637908878e64a020dd99c3bf98ad

  • SHA256

    4a1a9976a6fc9351ce34db0c601952328f52b526894cea614b51879c065e89a4

  • SHA512

    da5d985814986580a53712df240dad2dd876a16aeebab7e89ddc9968a8d2305dbf1cb695e1fa812ac534f27f1dfabf1be8aedac1f07d1b311163843f905a47a1

  • SSDEEP

    1536:SAXBcwCcPCxLgk2BeVbcqbhc48Ulk36nJNOOKLj:SAyvcPCaJe9Pbhc0hcOKLj

  Score

  10^/10

  xwormexecutionpersistencerattrojan

  • Detect Xworm Payload

  • Xworm

    Xworm is a remote access trojan written in C#.

    trojanratxworm

  • Command and Scripting Interpreter: PowerShell

    Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

    execution

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Drops startup file

  • Executes dropped EXE

  • Adds Run key to start application

    persistence

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  behavioral3

• • Target

    map.exe

  • Size

    61KB

  • MD5

    427cae9ddc40f9a7ea51459fc265d9be

  • SHA1

    8c68b6be3529637908878e64a020dd99c3bf98ad

  • SHA256

    4a1a9976a6fc9351ce34db0c601952328f52b526894cea614b51879c065e89a4

  • SHA512

    da5d985814986580a53712df240dad2dd876a16aeebab7e89ddc9968a8d2305dbf1cb695e1fa812ac534f27f1dfabf1be8aedac1f07d1b311163843f905a47a1

  • SSDEEP

    1536:SAXBcwCcPCxLgk2BeVbcqbhc48Ulk36nJNOOKLj:SAyvcPCaJe9Pbhc0hcOKLj

  Score

  10^/10

  xwormexecutionpersistencerattrojan

  • Detect Xworm Payload

  • Xworm

    Xworm is a remote access trojan written in C#.

    trojanratxworm

  • Command and Scripting Interpreter: PowerShell

    Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

    execution

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Drops startup file

  • Executes dropped EXE

  • Adds Run key to start application

    persistence

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  behavioral4