Extracted

• • Target

    Destiny Mod Menu/Destiny/Destiny Loader Installer.bat

  • Size

    265KB

  • MD5

    512d6ccd633decbe126a38c51c29a280

  • SHA1

    017e6fbb5eb2e367f37b4e5c33eb89cafcc7db48

  • SHA256

    411b2ce5f266c6b25a645c37e7fd071772810ae5c74cf457db20f43f43277fe5

  • SHA512

    fde1138b21117652348ec58f6ea92687fb94b111e0c49b5528d995a8e5e1588e7d1957761ca6eabb1010666f925b77a8032c129ec0839c5797a7e8381af24af7

  • SSDEEP

    6144:jhbd8sLlMG4UZT009TJPirdyKRxv4oPhdP:ld9Jdr96YitZdP

  Score

  10^/10

  executionxwormrattrojan

  • Detect Xworm Payload

  • Xworm

    Xworm is a remote access trojan written in C#.

    trojanratxworm

  • Xworm family

    xworm

  • Blocklisted process makes network request

  • Command and Scripting Interpreter: PowerShell

    Run Powershell and hide display window.

    execution

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  behavioral1behavioral2

• • Target

    Destiny Mod Menu/Destiny/Unistall.cmd

  • Size

    652B

  • MD5

    cbcf3f62d09c0384fac1e9aa7864eaf9

  • SHA1

    ef3c625e9bb9437bea730533565a77cff3f442ac

  • SHA256

    2ff897d3073ba334e43ad3ca2e65b6297b74d72931f45eda6caf6082b5b22768

  • SHA512

    95b982a66a396c1e79371521957299bde29df1eab65f4b1905fc64530ab1a1d109ae597448a183b79c596874d730d7a6a52ea7836aba7f4ca7fc8a3d306654ac

  Score

  1^/10
  behavioral3behavioral4