Extracted

Extracted

• • Target

    WaveInstaller_2.5.exe

  • Size

    35.9MB

  • MD5

    ee462d9e9b760b6d5f84847046fc608a

  • SHA1

    af4928d2d723ac17fcb7644e01e0c7a5be08bc49

  • SHA256

    f06d703e9fef41979a899049dc50232b950543e6a9c0adee9b652277e9be64ce

  • SHA512

    895efddeb85d6246d2cc6661baeb77ee66219ac0cecc5f826533e2c21b27b254d0ddf01d3e3895b89f83f87e91230cd777d6de159a290bdaef0acef22a85b28d

  • SSDEEP

    393216:m1Du8BtuBw2FEL3Z3aLUoQvo6LP/SgbSpYvKEh1EdKwlGQKPJuGsiTfREsrgCYfw:mMguj8Q4VfvlqFTrYV

  Score

  10^/10

  gurcuxwormexecutionratstealertrojan

  • Detect Xworm Payload

  • Gurcu, WhiteSnake

    Gurcu is a malware stealer written in C#.

    stealergurcu

  • Xworm

    Xworm is a remote access trojan written in C#.

    trojanratxworm

  • Blocklisted process makes network request

  • Command and Scripting Interpreter: PowerShell

    Run Powershell and hide display window.

    execution

  • Downloads MZ/PE file

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Drops startup file

  • Executes dropped EXE

  behavioral1behavioral2