Extracted

Extracted

• • Target

    Documents-main/bot2.exe

  • Size

    796KB

  • MD5

    40ee1549e8c99a64265e217620aefc9a

  • SHA1

    bd75e242951197e608dfb169166f30c79c48b4e8

  • SHA256

    aaf94802ec4fd06c7498021cdda4527dd3b51340648627f8a47a09778b863558

  • SHA512

    031481f173ed7f05ad54b84135ad3a01ea21e818a1ce41f6129f14df22dfa41db9b42ed67b91f93eafbc8d3fd34c1568e321f1c93f10585ee3df22f20f83d938

  • SSDEEP

    12288:6MSApJVYG5lDLyjsb0eOzkv4R7QnvUUilQ35+6G75V9Z1mG1Bj:6nsJ39LyjbJkQFMhmC+6GD9TXL

  Score

  10^/10

  xredxwormbackdoordiscoverymacropersistencerattrojan

  • Detect Xworm Payload

  • Xred

    Xred is backdoor written in Delphi.

    backdoorxred

  • Xred family

    xred

  • Xworm

    Xworm is a remote access trojan written in C#.

    trojanratxworm

  • Xworm family

    xworm

  • Downloads MZ/PE file

  • Suspicious Office macro

    Office document equipped with macros.

    macro

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Adds Run key to start application

    persistence

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  behavioral1behavioral2

• • Target

    Documents-main/phuongdonal-main/browser/consts.go

  • Size

    553B

  • MD5

    0fcd01d715dbc4ee16662cf0bf1b8336

  • SHA1

    594b861c91297ed5c04b3efc484d52a467469b68

  • SHA256

    f39b50b71e8adf790a25d15a7ec221e6d72a806f5bb49b59039bcfcb5c540734

  • SHA512

    9a77886c1b57d51db54363cd8ea800ef86be83d383a3c0b0815c8c6d3a9b686d4977b85a09d8af9a3910a7a3cc03c9dc074941be1c7bfd728ce4e5849b518d21

  Score

  8^/10

  executiondiscovery

  • Downloads MZ/PE file

  behavioral3behavioral4

• • Target

    Documents-main/phuongdonal-main/browser/firefox/firefox.go

  • Size

    5KB

  • MD5

    c2d2c1ff4c3b0889190318da4b203294

  • SHA1

    26834e820f1e9648856a2373cbe930fe8e7c1286

  • SHA256

    e0460cf0f05a8e74cb6e8cb1d1b5a2d50402cc03262bd18bafaa3c0526867fa9

  • SHA512

    f201a509bbab5f502ccb8849c9ac66846226b523bf53562cb3da944116a51f1bac7fcc50ff73bfa2ecbe8d50528cf780bf08febdd04878a54ec555cab7dfbd4d

  • SSDEEP

    96:WElBYeoESoe0RT+ow/IMkRl2IEN0C8bJhM99/9nefK:NYbEpDM0f+99lnMK

  Score

  8^/10

  executiondiscovery

  • Downloads MZ/PE file

  behavioral5behavioral6

• • Target

    Documents-main/phuongdonal-main/browserdata/extension/extension.go

  • Size

    4KB

  • MD5

    a0ae37182c9c8d8c18b916940dbfd7f0

  • SHA1

    914f770e202aaa48b8a7d4c2009bf2be1f8ac14c

  • SHA256

    0dae3270af6e589688ad9dd8943d3a40f6000fcedce87517051f7d899182dc69

  • SHA512

    e2cc2ca0e70b865638575ab0c560c65e273575c245bfadb4a44d39fd847720a6eb690adbbf8061505a1c555bc55bca9b4105cc5a6d9766505c5284febcc01d67

  • SSDEEP

    96:iGiWlSDyW4tue+u4Fte48ynljYhYpvqcp1PrlpnV3:iGiPDb9l9H3

  Score

  8^/10

  executiondiscovery

  • Downloads MZ/PE file

  behavioral7behavioral8

• • Target

    Documents-main/phuongdonal-main/browserdata/localstorage/localstorage.go

  • Size

    3KB

  • MD5

    f93b2514e454a9cd1b6131724fbfa334

  • SHA1

    ac1e8d4e4fdc425b302aecc6edd6a295cd001976

  • SHA256

    b9c44da23dce00a10d51cb689eb00609b4d941a481aae72b24c4cb8534f56a00

  • SHA512

    e42a042f73303b5505510e3b82075c2d20c26d2c13a33d6d0137487ec7d354f10323952c31c1877f7bc50abe30712a1ba06e3a42e9f6f8f83a6aa8d5f4f622a1

  Score

  8^/10

  discoveryexecution

  • Downloads MZ/PE file

  behavioral10behavioral9

• • Target

    Documents-main/phuongdonal-main/browserdata/outputter.go

  • Size

    7KB

  • MD5

    c73633f06023a1dc46ddf9dc831a5356

  • SHA1

    0f3e1646e241688b3e5a30d40d3cc8e418b8afc2

  • SHA256

    132528cf09775a56220b44a73478895ab0a42d92de3fac49c5499a288f081b3f

  • SHA512

    20a1c6dcdbd82ed2cb9edf938b12b6e9a5c0183a00105e153bcc673b3b66387540ca0f3161f7f4b31afa33b4475452bd47288555a0f399f61f2ee8db3dd8fb77

  • SSDEEP

    96:tT7RuC5bgAZb4GIKKs4kIYKnRF6XKcT7RV1CL2KTwchewyWlqsxY0H/L9JFr:5b514Gr3oPPq05f

  Score

  8^/10

  executiondiscovery

  • Downloads MZ/PE file

  behavioral11behavioral12

• • Target

    Documents-main/phuongdonal-main/browserdata/sessionstorage/sessionstorage.go

  • Size

    4KB

  • MD5

    6cb5105e133567c4e62bb0e1abe58ce8

  • SHA1

    744b4b925f012bcdb6b6fc9f0c1056f9e6079cd6

  • SHA256

    00c466653162110b6a74a9deebefcf205d5676e54b10df952e11ae940000cd5d

  • SHA512

    a58148ad8ac35e88e4321fd611b3a262f55e45f09c16a811d0bd305e9ed0eb9c6ae26a8bc7726bb5a20c818ccdcb5078e758409ff0c34aabb9fee9aa1aa43c01

  • SSDEEP

    96:KUwJ8ZmK4T36y+fsB3lnTArWw3XOzkOqB:KUJZm37z8WzkzB

  Score

  8^/10

  executiondiscovery

  • Downloads MZ/PE file

  behavioral13behavioral14

• • Target

    Documents-main/phuongdonal-main/cmd/photoshop/upx.exe

  • Size

    552KB

  • MD5

    28d3c8729e9f32294b0a239a930ce485

  • SHA1

    f5772134c2dbd15b4583bdd6896f46bcc3815ffe

  • SHA256

    b84ec2578a0a202aa84d3c41b4549dddb6dded096baa8d732b1c0cb0518c66f8

  • SHA512

    02c8daa6d37874dd1e6a38ed55869d690fafb3ddbf475c1ac0b0959f8f1b43a0456e293d3db6c4f9546468c3729ab6eb2163dcb5c99bed34563bb0c8aa5986b7

  • SSDEEP

    12288:BhLxVNdR2H62VyxwAZsOrvEJ3LBmoKH/qOaUjnDB57BIhKBzfnl/zR:BhFVCJMiveKbBQvaUjDB52K1fP

  Score

  8^/10

  upxdiscovery

  • Downloads MZ/PE file

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  behavioral15behavioral16

• • Target

    Documents-main/phuongdonal-main/go.lnk

  • Size

    2KB

  • MD5

    328fec281ebb306cf3024bbc0da652ab

  • SHA1

    695cc0a8d331a1128cfa01a1e0d8eb84f45f9c99

  • SHA256

    c210eb462cee60c72ef68ff1e758505fe2d57a81998395794ec37dc0fb29c751

  • SHA512

    9d23321da84622c8b51cee826ba3c76c71ddbf3b0388e769c0422123e76820296634e7f682964b900b56d54dc945ef58360c32b2373d8970c2a5009f214d14b3

  Score

  8^/10

  executiondiscovery

  • Command and Scripting Interpreter: PowerShell

    Run Powershell and hide display window.

    execution

  • Downloads MZ/PE file

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  behavioral17behavioral18

• • Target

    Documents-main/phuongdonal-main/logger/logger.go

  • Size

    2KB

  • MD5

    506561ae21897a6bcbbf64edf0e7944f

  • SHA1

    8182d813ae19001fd509d1380527010db567684a

  • SHA256

    2c55c4470915f1233a49646d282a176d8d013779974c37245052a1cc0936c213

  • SHA512

    2d9a0fdd70ba99eab70487a106adb3369f593d94b0be364dd01e6a405ba8c095ea8e3b2e11f44e0b1adefd779aa74d2090c6b4f8724776f1b175a10fb6766a39

  Score

  8^/10

  executiondiscovery

  • Downloads MZ/PE file

  behavioral19behavioral20

• • Target

    Documents-main/phuongdonal-main/types/types.go

  • Size

    3KB

  • MD5

    97c94e6fa9b4e8569df905ac8bb78e17

  • SHA1

    233cd9b4ab9d8872aa2fdcbac3a39f200f05bfa6

  • SHA256

    1ddd3ec178a5a3b099db919c37f992845cded3d5505064d95be3972c0c11d448

  • SHA512

    e745517c5f6c1241a9368c04f1b4e054ced342c1ed3142909565c88a373f7dac0f7ed3cf857bbbca1baa8db399b1a08032b21a54b1f81e4e1ac2a8c2c1893a82

  Score

  8^/10

  executiondiscovery

  • Downloads MZ/PE file

  behavioral21behavioral22

• • Target

    Documents-main/phuongdonal-main/utils/byteutil/byteutil.go

  • Size

    116B

  • MD5

    274372fee844cd93bd009f4b1757731c

  • SHA1

    d0ee501ad4ceeb79a4dec998bcdcf97a894a3b27

  • SHA256

    5f589f6083766bab398437d896f7be0bdbb64a545d533c8a5ad727166852090b

  • SHA512

    a94f87cf6b12eb4efcb04f9e8c267314acce9bbba105f417d673d1a4e38f4b5eb4b4ea365b838d49c1b4eccdb4a1ce04b3ae164ccfea7ad2e99ee47d3474a889

  Score

  8^/10

  executiondiscovery

  • Downloads MZ/PE file

  behavioral23behavioral24