Extracted

Extracted

Extracted

Extracted

• • Target

    31599bbf15939b4fbc91a6e228b436abfef3a213ece4d92cc6d8c90c905528ad.exe

  • Size

    2.1MB

  • MD5

    8c04e5d5adaf15173fecd9384ceda14d

  • SHA1

    9cbcf5134cfecb1a1f0c7e615a2a973ed8381e54

  • SHA256

    31599bbf15939b4fbc91a6e228b436abfef3a213ece4d92cc6d8c90c905528ad

  • SHA512

    7616ce8a0728abedb084c516b47fe45b7af264458d9fa4edccebbd2f8e77fbc17a703f06e8e23b9c618a45176a6073f6a5b0727619adf30f620eac062d58c0fe

  • SSDEEP

    24576:X40Bg3buy6rMn3I5bF2Wlo7XGc6okgFZ5A1WqJlLsYpd+wyQn652pBJTu:DCruyinbFOR6PgFZmMqJ19pd+wpXa

  Score

  10^/10

  gurcuxwormdiscoveryexecutionpersistenceratstealertrojan

  • Detect Xworm Payload

  • Gurcu, WhiteSnake

    Gurcu is a malware stealer written in C#.

    stealergurcu

  • Xworm

    Xworm is a remote access trojan written in C#.

    trojanratxworm

  • Blocklisted process makes network request

  • Command and Scripting Interpreter: PowerShell

    Run Powershell and hide display window.

    execution

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Drops startup file

  • Adds Run key to start application

    persistence

  • Suspicious use of SetThreadContext

  behavioral1behavioral2