Extracted

• • Target

    5d3f5e3134c740cd9154b677fe1f6465acd0efd74818220e8655de7296801727.exe

  • Size

    555KB

  • MD5

    7efdc7ca9699ef7177443900e5507ab2

  • SHA1

    94ff3238018e8d5e20b21cd5eaa83e5fcc3f6c73

  • SHA256

    5d3f5e3134c740cd9154b677fe1f6465acd0efd74818220e8655de7296801727

  • SHA512

    a08a21b4df939da53f070c647b3929b11dfceee470e624a1a8aad2a4d2c29f4c45f6acc3b9f00c0e25aa872ec5aa499249fae11b3585f17163d8626d7f6bcfa4

  • SSDEEP

    12288:32EIiN/Z1++w1p+wJuQbIgJwCQBk5wBcamd3ZhZs:3wiN/K+wHBfhQBk5s3mdPZs

  Score

  10^/10

  guloaderxwormdiscoverydownloaderexecutionrattrojan

  • Detect Xworm Payload

  • Guloader family

    guloader

  • Guloader,Cloudeye

    A shellcode based downloader first seen in 2020.

    downloaderguloader

  • Xworm

    Xworm is a remote access trojan written in C#.

    trojanratxworm

  • Xworm family

    xworm

  • Command and Scripting Interpreter: PowerShell

    Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

    execution

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Drops startup file

  • Loads dropped DLL

  • Suspicious use of NtCreateThreadExHideFromDebugger

  • Suspicious use of NtSetInformationThreadHideFromDebugger

  • Suspicious use of SetThreadContext

  behavioral1behavioral2

• • Target

    $PLUGINSDIR/System.dll

  • Size

    11KB

  • MD5

    75ed96254fbf894e42058062b4b4f0d1

  • SHA1

    996503f1383b49021eb3427bc28d13b5bbd11977

  • SHA256

    a632d74332b3f08f834c732a103dafeb09a540823a2217ca7f49159755e8f1d7

  • SHA512

    58174896db81d481947b8745dafe3a02c150f3938bb4543256e8cce1145154e016d481df9fe68dac6d48407c62cbe20753320ebd5fe5e84806d07ce78e0eb0c4

  • SSDEEP

    192:X24sihno0bW+l97H4GB7QDs91kMtwtobTr4u+QHbazMNHT7dmNIEr:m8vJl97JeoxtN/r3z7YV

  Score

  3^/10

  discovery
  behavioral3behavioral4