Extracted

Extracted

• • Target

    FPS_Boost_1_bat.zip

  • Size

    4KB

  • MD5

    e1758b6bc7aac65efd538264595fb1cb

  • SHA1

    a3bd62259c9d3fe9ef148e9cc728ca6cd662779e

  • SHA256

    51bd7eb315dace468e4b936601f8ff6d3936f6935a4cefd0402e59802bbfa855

  • SHA512

    ec3eef846f4144e11f8a6c09426356cdc4d77950757724003ea1ee1bcd63ee86348462f6d31568008d44d01cbd9333aa61f33260a71a4c3a3c4fcef0fbd634a1

  • SSDEEP

    96:tSmQTWstt675g83x8U9B7fwwFN0XiGPPrs+ZzNq:tJ2ttSg83xxswv8rsIE

  Score

  10^/10

  gurcuxwormevasionexecutionpersistenceratstealertrojan

  • Detect Xworm Payload

  • Gurcu, WhiteSnake

    Gurcu is a malware stealer written in C#.

    stealergurcu

  • Modifies visibility of file extensions in Explorer

    evasion

  • Modifies visiblity of hidden/system files in Explorer

    evasion

  • UAC bypass

    evasiontrojan

  • Xworm

    Xworm is a remote access trojan written in C#.

    trojanratxworm

  • Blocklisted process makes network request

  • Boot or Logon Autostart Execution: Active Setup

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

    persistence

  • Command and Scripting Interpreter: PowerShell

    Using powershell.exe command.

    execution

  • Drops file in Drivers directory

  • Enumerates connected drives

    Attempts to read the root path of hard drives other than the default C: drive.

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Drops file in System32 directory

  behavioral1