Analysis
-
max time kernel
121s -
max time network
129s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
-
submitted
08/03/2025, 05:34
General
-
Target
Kunzi/KunziSpoofer.exe
-
Size
76KB
-
MD5
5d15d2ea7e1adf32489a73cc4a1b8a6d
-
SHA1
0a2e7b7f8d67c0ffb2b80d68657baaf1593ca8cd
-
SHA256
24ef64893177dcdb3b5156143b3d59d95857585508269cdbf24ad831dfad2747
-
SHA512
f72ee020c560d3d5cc8afc1244022d41557f67b63b16c312324d444c31096fa8362d827960ee32a5da1d9615017b32a8a2f7f30192d894fae431465bd8deb58d
-
SSDEEP
768:ta0mWhFFObZnFabjsQZzzUN0SHtZ4vXMbwSDgXTDaoba6HJxtqzzO8v38Jh+cag8:tajyj3FzQltZ6cbwvTDo6JyO8vIFaBD
Score
10/10
Malware Config
Extracted
Family
xworm
C2
defined-literary.gl.at.ply.gg:39055
Attributes
-
Install_directory
%LocalAppData%
Signatures
-
Detect Xworm Payload 1 IoCs
-
Xworm
Xworm is a remote access trojan written in C#.
-
Xworm family
-
Looks up external IP address via web service 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
-
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\Kunzi\KunziSpoofer.exe"C:\Users\Admin\AppData\Local\Temp\Kunzi\KunziSpoofer.exe"1⤵
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
4KB
-
Filesize
104KB
-
Filesize
9.9MB
-
Filesize
9.9MB