Extracted

• • Target

    Shipping doc.exe

  • Size

    619KB

  • MD5

    f04045696fc138e5b37ce3a614b009dd

  • SHA1

    90ad0d42c91f1e63cd241269a74c2b2bcb7f785b

  • SHA256

    c631b3586ae88b9952c7541fbc6d490f9906b870fc12397a8c7bb84e07eab6cd

  • SHA512

    35befc8000afdc23a5d343afc538b5848ae57466f13364c98e1d75a9d9b67852a76c56c203ee3ded606d4e6b81b70ef8a374ea982b309bcc229627ade298fc6e

  • SSDEEP

    12288:2iuvt+JET0nPj/w7XUJRRsZsnpuCVEMdwal42220w71k6MIFSwnOXafXTvqoo6qy:iV+JEwnPj/w7astCVep2upWrdTb6y

  Score

  10^/10

  guloaderxwormdiscoverydownloaderrattrojan

  • Detect Xworm Payload

  • Guloader family

    guloader

  • Guloader,Cloudeye

    A shellcode based downloader first seen in 2020.

    downloaderguloader

  • Xworm

    Xworm is a remote access trojan written in C#.

    trojanratxworm

  • Xworm family

    xworm

  • Loads dropped DLL

  • Legitimate hosting services abused for malware hosting/C2

  • Suspicious use of NtCreateThreadExHideFromDebugger

  • Suspicious use of NtSetInformationThreadHideFromDebugger

  behavioral1behavioral2

• • Target

    $PLUGINSDIR/System.dll

  • Size

    11KB

  • MD5

    be2621a78a13a56cf09e00dd98488360

  • SHA1

    75f0539dc6af200a07cdb056cddddec595c6cfd2

  • SHA256

    852047023ba0cae91c7a43365878613cfb4e64e36ff98c460e113d5088d68ef5

  • SHA512

    b80cf1f678e6885276b9a1bfd9227374b2eb9e38bb20446d52ebe2c3dba89764aa50cb4d49df51a974478f3364b5dbcbc5b4a16dc8f1123b40c89c01725be3d1

  • SSDEEP

    192:eB2HS+ihg200uWz947Wzvxu6v0MI7JOde+Ij5Z77dslFsE+:3S62Gw947ExuGDI7J8EF7KIE

  Score

  3^/10

  discovery
  behavioral3behavioral4