Extracted

Extracted

• • Target

    2024-12-20_1ca90ba487b5c8d6c88ec057c64d9234_avoslocker_hijackloader_luca-stealer

  • Size

    8.6MB

  • MD5

    1ca90ba487b5c8d6c88ec057c64d9234

  • SHA1

    17dd50607690977d796952904a13113efba19219

  • SHA256

    c4725acb89a78055d4f6115483ead7545dab60cfebc3193b0264b9c41e63b6a2

  • SHA512

    b0abbff71ef81581490cf17e2b0e4398735e7ae6082fdcf75e864b23d96cd0acd5f4e9df9429cc8c71ab475ab7289bc10cbc4f8f073090576732f36294d4604d

  • SSDEEP

    98304:uwIMFaSRowIMFaSRYwIMFaSRowIMFaSRwwIMFaSR6OU/jIEeQfoR/IuOFVjUu5:TJRNJR9JRNJRFJR6FIF0wu

  Score

  10^/10

  xredxwormbackdoordiscoveryexecutionpersistencerattrojan

  • Detect Xworm Payload

  • Xred

    Xred is backdoor written in Delphi.

    backdoorxred

  • Xred family

    xred

  • Xworm

    Xworm is a remote access trojan written in C#.

    trojanratxworm

  • Xworm family

    xworm

  • Command and Scripting Interpreter: PowerShell

    Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

    execution

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Adds Run key to start application

    persistence

  • Suspicious use of SetThreadContext

  behavioral1behavioral2