Extracted

• • Target

    526231515215api2535forms.exe

  • Size

    1002KB

  • MD5

    eda4d61a350236937e265ed2c2e2e666

  • SHA1

    382707fd6300a57d955da0c5333f41eb12d67073

  • SHA256

    2eade1e13548c453abaf7f320aa91034d849c2adbba8ddced41fccb27d8cde1c

  • SHA512

    941a99ce65f667f8588e9c9ed2116567b08db2b9c64927e1cf13579b4ac14f19eae40c350df0f46a43a372946ac6bb3a6841873f37a8909bac73caafc42e3658

  • SSDEEP

    24576:QN5CyziiwG6B/8ZKDCOQhoRg8mhUsiNj+AoxCUYMN+QQLZ:w5CAi3G6B/8EXRgriIAoLNZQ1

  Score

  10^/10

  guloaderdiscoverydownloaderxwormrattrojan

  • Detect Xworm Payload

  • Guloader family

    guloader

  • Guloader,Cloudeye

    A shellcode based downloader first seen in 2020.

    downloaderguloader

  • Xworm

    Xworm is a remote access trojan written in C#.

    trojanratxworm

  • Xworm family

    xworm

  • Loads dropped DLL

  • Suspicious use of NtCreateThreadExHideFromDebugger

  • Suspicious use of NtSetInformationThreadHideFromDebugger

  behavioral1behavioral2

• • Target

    $PLUGINSDIR/System.dll

  • Size

    12KB

  • MD5

    cff85c549d536f651d4fb8387f1976f2

  • SHA1

    d41ce3a5ff609df9cf5c7e207d3b59bf8a48530e

  • SHA256

    8dc562cda7217a3a52db898243de3e2ed68b80e62ddcb8619545ed0b4e7f65a8

  • SHA512

    531d6328daf3b86d85556016d299798fa06fefc81604185108a342d000e203094c8c12226a12bd6e1f89b0db501fb66f827b610d460b933bd4ab936ac2fd8a88

  • SSDEEP

    192:Zjvco0qWTlt70m5Aj/lQ0sEWD/wtYbBHFNaDybC7y+XBz0QPi:FHQlt70mij/lQRv/9VMjzr

  Score

  3^/10

  discovery
  behavioral3behavioral4