Extracted

Extracted

• • Target

    NeuraX-SpooferTEMP.exe

  • Size

    368KB

  • MD5

    35c6f16313a956763c7402b49499b1f9

  • SHA1

    8f12a11413044b39cdd626be408aaae50254e4a5

  • SHA256

    d76a5a1ae2f2537b56c7e0499ab5f0c8ea28d7efbbc9793a5174aabbedc74f4e

  • SHA512

    fa16a5e069f5c0133674c5d3a515162a43c68cb619cf646b499fbd20b66dbc50a1dcd38003eeaa9335a95d432a8aa5bca1d0d6814011007d46b80e9556331cac

  • SSDEEP

    6144:/3KWL1LMxGp99JRlnzN6gqoZ7zms0oXgd6TKU6EKKXclsBGlDstmvcHcI0us:/PLMxGpPJvzNZZ7iqgoTR2+ED0m0Hc6

  Score

  10^/10

  umbralxwormratstealertrojan

  • Detect Umbral payload

  • Detect Xworm Payload

  • Umbral

    Umbral stealer is an opensource moduler stealer written in C#.

    stealerumbral

  • Umbral family

    umbral

  • Xworm

    Xworm is a remote access trojan written in C#.

    trojanratxworm

  • Xworm family

    xworm

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Drops startup file

  • Executes dropped EXE

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  behavioral1behavioral2