Extracted

• • Target

    Luxury Shield 12.8.9.zip

  • Size

    9.6MB

  • MD5

    8067ac7cd02c1a3bb18b2a6a56597c3a

  • SHA1

    1df850e23a06480dcd3a1af122a2e14382a4578f

  • SHA256

    201f9fbaaa715f934e0f89d07aba1fa080fe17839ea64b776e1e69ce11451783

  • SHA512

    1286bfab21376c45317c870c266ad65a64ddba4d949c2f96541ace359210a76c2957ba6d5a2b888ec3e63aad919b4c8ee5e06f606e83aa0b41bd4f306131b779

  • SSDEEP

    196608:AxMKs19qZm4Lvx8fMF6J8zD6sL+oPI6vkCsu90NQ1VL9rm0AbBwbtr6LHYVjHnA:A7GEm4Lv2fM8wD5+H6DuK1VI0Al4A

  Score

  10^/10

  redlinexwormdiscoveryexecutioninfostealerpersistencerattrojan

  • Detect Xworm Payload

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    infostealerredline

  • RedLine payload

  • Redline family

    redline

  • Xworm

    Xworm is a remote access trojan written in C#.

    trojanratxworm

  • Xworm family

    xworm

  • Command and Scripting Interpreter: PowerShell

    Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

    execution

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Drops startup file

  • Executes dropped EXE

  • Adds Run key to start application

    persistence

  • Suspicious use of SetThreadContext

  behavioral1