Extracted

Extracted

• • Target

    PIN-Cracker 3.0.0.exe

  • Size

    173KB

  • MD5

    253ab905c2841c7ab2c2cde6c6bb7117

  • SHA1

    0d4fb7cb90e2f7cae1fe43cae48192a0fb7b4e4f

  • SHA256

    59f361f8b4a5be7e76e2bae6e4d0515aff7b49bd7d9c896b401335bde8cba1f5

  • SHA512

    afc9a1228fd620d0af1da522fa8f9954673b2d6a51624c83dbdb0272e01f6693d584058ea743dfc939a8834010ebf2af7f1db3ba497a9f51d35dacc449105505

  • SSDEEP

    3072:QahKyd2n31K5GWp1icKAArDZz4N9GhbkrNEkpkKLxF:QahOup0yN90QE8

  Score

  10^/10

  gurcuxwormexecutionpersistenceratspywarestealertrojan

  • Detect Xworm Payload

  • Gurcu, WhiteSnake

    Gurcu is a malware stealer written in C#.

    stealergurcu

  • Xworm

    Xworm is a remote access trojan written in C#.

    trojanratxworm

  • Blocklisted process makes network request

  • Command and Scripting Interpreter: PowerShell

    Powershell Invoke Web Request.

    execution

  • Downloads MZ/PE file

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Drops startup file

  • Executes dropped EXE

  • Loads dropped DLL

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Adds Run key to start application

    persistence

  • Legitimate hosting services abused for malware hosting/C2

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • An obfuscated cmd.exe command-line is typically used to evade detection.

  behavioral1