Extracted

Extracted

• • Target

    RustAnticheat.exe

  • Size

    1.1MB

  • MD5

    51d835de66bac2f502ae697a35baec90

  • SHA1

    46ed68b3af1160c892090db77dbfd8916128afee

  • SHA256

    544a9c11e53d104ee4987900bebeb849490735d2d3a076dd468bcdedd83b6fde

  • SHA512

    1be17435d526b464aee3e453295feb831030a4ec9d87c1a4d47eee9b32a3728675fc29ff35143991209e75c5804d02612da31c51dbbad8a6054f03ad01660746

  • SSDEEP

    24576:kEKrzjpnzLOtAi9SrsvNOOZT8XYYLvqKaZ2IJhaOtlj:dKr3hL4+yRT3KaIIj

  Score

  10^/10

  umbralxwormdiscoveryratstealertrojan

  • Detect Umbral payload

  • Detect Xworm Payload

  • Umbral

    Umbral stealer is an opensource moduler stealer written in C#.

    stealerumbral

  • Xworm

    Xworm is a remote access trojan written in C#.

    trojanratxworm

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  behavioral1behavioral2behavioral3behavioral4behavioral5