Extracted

Extracted

Extracted

• • Target

    bcc75a703d829adfb645704ac8e9772cfe320fee82ceedcbf1bebb40182aaa13

  • Size

    64.6MB

  • MD5

    7854056968780ef9d932c48f3c404b8d

  • SHA1

    51be32f3ba072e907c1d77b3ad0fdaf9150c9631

  • SHA256

    bcc75a703d829adfb645704ac8e9772cfe320fee82ceedcbf1bebb40182aaa13

  • SHA512

    154c3f5e7dfd9b4faa7e8d160afc9d8e91abd31d9e38c55e445ea978c0df0ce0cd970fcd426dc8e8f0cf5fd11c30c456665b076c2f92d0da2be3e3ed63794a16

  • SSDEEP

    1572864:UkTQtD108qdyfZFBanNsnIfnbJYuWiiXS4/6rUXPsDrTSC:UN910xdyfdManIfbJG5D/6rUXPESC

  Score

  10^/10

  gurculummaxwormdefense_evasiondiscoveryratstealertrojan

  • Detect Xworm Payload

  • Gurcu, WhiteSnake

    Gurcu is a malware stealer written in C#.

    stealergurcu

  • Lumma Stealer, LummaC

    Lumma or LummaC is an infostealer written in C++ first seen in August 2022.

    stealerlumma

  • Xworm

    Xworm is a remote access trojan written in C#.

    trojanratxworm

  • Drops startup file

  • Executes dropped EXE

  • Loads dropped DLL

  • Legitimate hosting services abused for malware hosting/C2

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Network Service Discovery

    Attempt to gather information on host's network.

    discovery

  • Enumerates processes with tasklist

    discovery

  • Hide Artifacts: Hidden Files and Directories

    defense_evasion

  • Suspicious use of SetThreadContext

  behavioral1