Extracted

• • Target
    a7247c64cc0168290ca3b210e59ef629b46f513205bc6562ec79cdd2cda71725N.exe
  • Size 555KB
  • SHA256 a7247c64cc0168290ca3b210e59ef629b46f513205bc6562ec79cdd2cda71725
  • MD5 18ea5087eb82e075ca35d2b2dcff9450
  • SHA1 dc436fbaa777672d44a8b90b98c4a1c266885845
  • SHA512 8fbeb3caf13a3fe1359002c2848ff5767e6b2f226049546c683f2b6144756196cfe39f66e4959c8426cdfaeff6a169a4cf5939de241e4a898887d8810ec620c6
  • SSDEEP 12288:32EIiN/Z1++w1p+wJuQbIgJwCQBk5wBcamd3ZhZs:3wiN/K+wHBfhQBk5s3mdPZs
  • MD5 SHA1 SHA512 SSDEEP

  Score

  10^/10

  guloaderxwormdiscoverydownloaderexecutionrattrojan

  • Detect Xworm Payload

  • Guloader family

    guloader

  • Guloader,Cloudeye

    A shellcode based downloader first seen in 2020.

    downloaderguloader

  • Xworm

    Xworm is a remote access trojan written in C#.

    trojanratxworm

  • Xworm family

    xworm

  • Command and Scripting Interpreter: PowerShell

    Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

    execution

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Drops startup file

  • Loads dropped DLL

  • Suspicious use of NtCreateThreadExHideFromDebugger

  • Suspicious use of NtSetInformationThreadHideFromDebugger

  • Suspicious use of SetThreadContext

  behavioral1behavioral2
• • Target
    $PLUGINSDIR/System.dll
  • Size 11KB
  • SHA256 a632d74332b3f08f834c732a103dafeb09a540823a2217ca7f49159755e8f1d7
  • MD5 75ed96254fbf894e42058062b4b4f0d1
  • SHA1 996503f1383b49021eb3427bc28d13b5bbd11977
  • SHA512 58174896db81d481947b8745dafe3a02c150f3938bb4543256e8cce1145154e016d481df9fe68dac6d48407c62cbe20753320ebd5fe5e84806d07ce78e0eb0c4
  • SSDEEP 192:X24sihno0bW+l97H4GB7QDs91kMtwtobTr4u+QHbazMNHT7dmNIEr:m8vJl97JeoxtN/r3z7YV
  • MD5 SHA1 SHA512 SSDEEP

  Score

  3^/10

  discovery
  behavioral3behavioral4