Extracted

• • Target

    Destiny Mod Menu.rar

  • Size

    194KB

  • MD5

    d1e398e757c4a3e1c9887296cef12b34

  • SHA1

    197c715389fba91d476d395bb0c9439009b9a1da

  • SHA256

    10f65b5ff82a1838a20614cc7bf379e8f55c3d46ef9ecaba7837c17ec44ce49f

  • SHA512

    bafe205c3727f954d15d3046881a6989b4bd8541f472cdfa5bd22211616f97b5ff591fb45ef159ea910dce30fb98e034ff0bb8f9e237c629e75b59a78504ef28

  • SSDEEP

    6144:KR9UeLmjjYjgRT+IZbnVqjmxAvAhZrM/BBDnjMy0VMugzsS:Cyeak0hjZE2AoTWBfpugB

  Score

  10^/10

  xwormexecutionrattrojan

  • Detect Xworm Payload

  • Xworm

    Xworm is a remote access trojan written in C#.

    trojanratxworm

  • Xworm family

    xworm

  • Blocklisted process makes network request

  • Command and Scripting Interpreter: PowerShell

    Run Powershell and hide display window.

    execution

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  behavioral1behavioral2

• • Target

    Destiny Mod Menu/Destiny/Destiny Loader Installer.bat

  • Size

    265KB

  • MD5

    512d6ccd633decbe126a38c51c29a280

  • SHA1

    017e6fbb5eb2e367f37b4e5c33eb89cafcc7db48

  • SHA256

    411b2ce5f266c6b25a645c37e7fd071772810ae5c74cf457db20f43f43277fe5

  • SHA512

    fde1138b21117652348ec58f6ea92687fb94b111e0c49b5528d995a8e5e1588e7d1957761ca6eabb1010666f925b77a8032c129ec0839c5797a7e8381af24af7

  • SSDEEP

    6144:jhbd8sLlMG4UZT009TJPirdyKRxv4oPhdP:ld9Jdr96YitZdP

  Score

  10^/10

  executionxwormrattrojan

  • Detect Xworm Payload

  • Xworm

    Xworm is a remote access trojan written in C#.

    trojanratxworm

  • Xworm family

    xworm

  • Blocklisted process makes network request

  • Command and Scripting Interpreter: PowerShell

    Run Powershell and hide display window.

    execution

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  behavioral3behavioral4

• • Target

    Destiny Mod Menu/Destiny/Proof its Safe.txt

  • Size

    110B

  • MD5

    d240585e5822cccb37278d4d29e0b41c

  • SHA1

    b08eb6dbfbf513fe4ffe0e6518f60dd0c1f5e96e

  • SHA256

    930e2a87600be389d51096e1ee904fd5927abf9bbbd5a9a44b4daec697756e09

  • SHA512

    8cef251fe65b60c016d4d410675f31d6bfa8c84f128cac5af47188223b7bb80c71a213355fcdbefd3f1d8d63eee3242f3f340f1ea05227c96a9ade935ba03c41

  Score

  1^/10
  behavioral5behavioral6

• • Target

    Destiny Mod Menu/Destiny/Unistall.cmd

  • Size

    652B

  • MD5

    cbcf3f62d09c0384fac1e9aa7864eaf9

  • SHA1

    ef3c625e9bb9437bea730533565a77cff3f442ac

  • SHA256

    2ff897d3073ba334e43ad3ca2e65b6297b74d72931f45eda6caf6082b5b22768

  • SHA512

    95b982a66a396c1e79371521957299bde29df1eab65f4b1905fc64530ab1a1d109ae597448a183b79c596874d730d7a6a52ea7836aba7f4ca7fc8a3d306654ac

  Score

  1^/10
  behavioral7behavioral8