Extracted

Extracted

• • Target

    EternalPredictor.exe

  • Size

    17.6MB

  • MD5

    7d207c243b33d6f3d78acadffd95ae0e

  • SHA1

    a3ad8109c208b12d35359e78f4ebc23ed79ccf24

  • SHA256

    dc23f531b2e23535601968a1453a45565c9214264d4ef3d016c0a983ed720c30

  • SHA512

    ac9740408cd0dc7ff93835defed55af7359456eaa2cd092704e6f7ffe5fa3ea3b87d9ab927e4c06e96f9c030f8dc14cffe157ccf74618aa4ea9c33d875fca0fd

  • SSDEEP

    393216:U8o6tLbdhAQdfxvzbjv1sIUO82oi61Mlk+kv4af0ADcOeIsP:UsbPJpvpn82oi6ulkPLf0WcOeR

  Score

  10^/10

  skuldxwormpersistenceratstealertrojanupxcollectioncredential_accessdefense_evasiondiscoveryexecutionprivilege_escalationspyware

  • Detect Xworm Payload

  • Skuld family

    skuld

  • Skuld stealer

    An info stealer written in Go lang.

    stealerskuld

  • Xworm

    Xworm is a remote access trojan written in C#.

    trojanratxworm

  • Xworm family

    xworm

  • Command and Scripting Interpreter: PowerShell

    Using powershell.exe command.

    execution

  • Drops file in Drivers directory

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Clipboard Data

    Adversaries may collect data stored in the clipboard from users copying information within or between applications.

    collection

  • Drops startup file

  • Executes dropped EXE

  • Loads dropped DLL

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Unsecured Credentials: Credentials In Files

    Steal credentials from unsecured files.

    credential_accessstealer

  • Accesses cryptocurrency files/wallets, possible credential harvesting

    spyware

  • Adds Run key to start application

    persistence

  • Legitimate hosting services abused for malware hosting/C2

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Obfuscated Files or Information: Command Obfuscation

    Adversaries may obfuscate content during command execution to impede detection.

    defense_evasion

  • Enumerates processes with tasklist

    discovery

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  behavioral1behavioral2behavioral3