Extracted

Extracted

Extracted

Extracted

• • Target

    0cf06c833517acebaebf18e5b36edccb4903a112117dbee1a19f9b76c7a7b36f.exe

  • Size

    2.1MB

  • MD5

    de2b7ec32d3a5c530e5a1aa6f2b27b16

  • SHA1

    83c3c02a1c5746882094939ed4f1ab61954ff8f0

  • SHA256

    0cf06c833517acebaebf18e5b36edccb4903a112117dbee1a19f9b76c7a7b36f

  • SHA512

    e76d643dc5fad7de78172bafe3b33da231bbce76fb2c46235338e811112f32775dfd20acf770141808ee00c0e9527829933d9ec1ee04c776b774eff80168bee8

  • SSDEEP

    24576:S/BARUsXRaTX3P/drZ6p7Ut2Qcbgn5DFIOG+N3mYm8hz8UQn652/BJOD:i2HXRWXdrEDQ0gn5xfG+8H8hz8rdm

  Score

  10^/10

  gurcuxwormdiscoveryexecutionpersistenceratstealertrojan

  • Detect Xworm Payload

  • Gurcu, WhiteSnake

    Gurcu is a malware stealer written in C#.

    stealergurcu

  • Xworm

    Xworm is a remote access trojan written in C#.

    trojanratxworm

  • Blocklisted process makes network request

  • Command and Scripting Interpreter: PowerShell

    Using powershell.exe command.

    execution

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Drops startup file

  • Executes dropped EXE

  • Adds Run key to start application

    persistence

  • Legitimate hosting services abused for malware hosting/C2

  • Suspicious use of SetThreadContext

  behavioral1behavioral2