Extracted

Extracted

• • Target

    XLOADER.exe

  • Size

    165KB

  • MD5

    35faa4d7d6a4ce2d4af4c66f42547af7

  • SHA1

    e844d33f3bd11f49822e0314732c7a13e9ee8e29

  • SHA256

    ef1737d52757e66af3d80c1a64ee974236f011783cb54960a1f6adc5a47386fa

  • SHA512

    baa7c5a212dff66fedbf6ed3325ad3cd9dc17831a35450125a63ebecd735df1a16ce4362c6e8518586b6f5895b3950f4573cf8721e55a9fcc67d1fddb35ea3e2

  • SSDEEP

    3072:LrLWKPAfXXXMaaJBGye1k07+X7hje/MbuYDDs6POkfEKVRuLS:LuY2XSJB7e1LIwEbDDBmkfEK

  Score

  10^/10

  gurcuxwormexecutionpersistenceratstealertrojan

  • Detect Xworm Payload

  • Gurcu family

    gurcu

  • Gurcu, WhiteSnake

    Gurcu aka WhiteSnake is a malware stealer written in C#.

    stealergurcu

  • Xworm

    Xworm is a remote access trojan written in C#.

    trojanratxworm

  • Xworm family

    xworm

  • Command and Scripting Interpreter: PowerShell

    Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

    execution

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Drops startup file

  • Executes dropped EXE

  • Adds Run key to start application

    persistence
  behavioral1