Extracted

Extracted

Extracted

Extracted

• • Target
    Kling_CompletedPhoto.png.exe
  • Size 65.8MB
  • SHA256 409b00bb07631e7425f5818b5badbee0e30491a7a89849ccefc6852d78af434e
  • MD5 4e57a4ffcd80f3323997b7f4d287c43b
  • SHA1 a5219f47566c3859d4163de2b2248779e4b348c3
  • SHA512 db7ecfc778bcd02b7ab2ad0845120c1303c97831151c83316e1d3b731f8ae41e73a18791d5774d60b7f2062ee0a11c178124cf127fb7d54c804dce97e0233279
  • SSDEEP 1572864:1pwUgUIgIeCSI9JF+8e2eSLYQA//1YCZG0ISKATMQjlh7k:1hC33VR0Qk/yOGjCMwDk
  • MD5 SHA1 SHA512 SSDEEP

  Score

  10^/10

  gurculummaxwormdefense_evasiondiscoveryratstealertrojan

  • Detect Xworm Payload

  • Gurcu, WhiteSnake

    Gurcu is a malware stealer written in C#.

    stealergurcu

  • Lumma Stealer, LummaC

    Lumma or LummaC is an infostealer written in C++ first seen in August 2022.

    stealerlumma

  • Xworm

    Xworm is a remote access trojan written in C#.

    trojanratxworm

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Drops startup file

  • Executes dropped EXE

  • Loads dropped DLL

  • Legitimate hosting services abused for malware hosting/C2

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Network Service Discovery

    Attempt to gather information on host's network.

    discovery

  • Enumerates processes with tasklist

    discovery

  • Hide Artifacts: Hidden Files and Directories

    defense_evasion

  • Suspicious use of SetThreadContext

  behavioral1behavioral2