Extracted

Extracted

Extracted

• • Target
    bcc75a703d829adfb645704ac8e9772cfe320fee82ceedcbf1bebb40182aaa13
  • Size 64.6MB
  • SHA256 bcc75a703d829adfb645704ac8e9772cfe320fee82ceedcbf1bebb40182aaa13
  • MD5 7854056968780ef9d932c48f3c404b8d
  • SHA1 51be32f3ba072e907c1d77b3ad0fdaf9150c9631
  • SHA512 154c3f5e7dfd9b4faa7e8d160afc9d8e91abd31d9e38c55e445ea978c0df0ce0cd970fcd426dc8e8f0cf5fd11c30c456665b076c2f92d0da2be3e3ed63794a16
  • SSDEEP 1572864:UkTQtD108qdyfZFBanNsnIfnbJYuWiiXS4/6rUXPsDrTSC:UN910xdyfdManIfbJG5D/6rUXPESC
  • MD5 SHA1 SHA512 SSDEEP

  Score

  10^/10

  gurculummaxwormdefense_evasiondiscoveryratstealertrojan

  • Detect Xworm Payload

  • Gurcu, WhiteSnake

    Gurcu is a malware stealer written in C#.

    stealergurcu

  • Lumma Stealer, LummaC

    Lumma or LummaC is an infostealer written in C++ first seen in August 2022.

    stealerlumma

  • Xworm

    Xworm is a remote access trojan written in C#.

    trojanratxworm

  • Drops startup file

  • Executes dropped EXE

  • Loads dropped DLL

  • Legitimate hosting services abused for malware hosting/C2

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Network Service Discovery

    Attempt to gather information on host's network.

    discovery

  • Enumerates processes with tasklist

    discovery

  • Hide Artifacts: Hidden Files and Directories

    defense_evasion

  • Suspicious use of SetThreadContext

  behavioral1