Extracted

Extracted

• • Target

    svchost.exe

  • Size

    90KB

  • MD5

    8f535a06fc7c41dcef821b0459066961

  • SHA1

    279430ac0656ca0863aea9e02e47bd1988fa63c1

  • SHA256

    acd88b193946ae308f578a08a3426bf6d162f6af6f01401ba264b01e732bbddc

  • SHA512

    0ffe370fe384b4a7dc3b8003f7d9e7a5901bb9cf7d3524852db3dbad3b8dc0f3ec3de9a0787db72d79c2ded1166e8ea3b8772e0841e776793ecc2996b3aa729f

  • SSDEEP

    1536:2BveucywHzpDOGugyUGlFCxdGqPKlbuQbcfhE50T6UiLlOBDf1vJJF82jik:kvcySpDImxalbuVhE9lOVf1vbh

  Score

  10^/10

  gurcuxwormevasionexecutionpersistenceratstealertrojandiscoveryransomware

  • Detect Xworm Payload

  • Gurcu, WhiteSnake

    Gurcu is a malware stealer written in C#.

    stealergurcu

  • Modifies WinLogon for persistence

    persistence

  • UAC bypass

    evasiontrojan

  • Xworm

    Xworm is a remote access trojan written in C#.

    trojanratxworm

  • Command and Scripting Interpreter: PowerShell

    Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

    execution

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Checks whether UAC is enabled

    evasiontrojan

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Sets desktop wallpaper using registry

    ransomware
  behavioral1behavioral2