Extracted

• • Target
    Grey Spoofer/Grey Spoofer.bat
  • Size 2.9MB
  • SHA256 b4bf087bdd0c8a6ed7fba9be38b8de366d10bdb158d84200707e534fa007172d
  • MD5 7dcc87628bb7afaa189f653dd1fe2f37
  • SHA1 f4fa42b50217a3c5c484ede5c4b41fa0b65ee573
  • SHA512 3ce8b93c243d684846c64f706c7f5ff954d8436c398fcd27da401bb1b5553fc8b878d5408a2568e4453b8950eb6a8ea88106760ab7859967c9acaed33b51a0a5
  • SSDEEP 24576:VMkmMN6caU80VAwCxHrWIDlCNMe/81g7kr/LHYGCPVGuVbMVhzMGhQUcjJ+L88su:arcYDlCespDVcheoW7lJXECU
  • MD5 SHA1 SHA512 SSDEEP

  Score

  10^/10

  xwormexecutionrattrojan

  • Detect Xworm Payload

  • Xworm

    Xworm is a remote access trojan written in C#.

    trojanratxworm

  • Xworm family

    xworm

  • Blocklisted process makes network request

  • Command and Scripting Interpreter: PowerShell

    Run Powershell and hide display window.

    execution

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  behavioral1
• • Target
    Grey Spoofer/obsidium64.dll
  • Size 312KB
  • SHA256 6d8361489584a1d7f657d5c62b3d5ecc5c4277eb22304dc8557597cd5e494fab
  • MD5 04309f41d97720db02726c018f2c885f
  • SHA1 1dce4a32292f1bf5d0de9eb906ae1dba9bc247a8
  • SHA512 355727bedbd8b1041ee963f48d9567609521e83a53822b53495310e900df52a39c5530725ceb1f9622eeb9b202d80bd3202e753a9d8fa0c00873fe0282472906
  • SSDEEP 6144:cd/WbSly6M50creIhrx0nOWK52d5B7GFQkQcF2DYhftO26N7IsL0V:QZ46M5NPt0OWK5K51GQkNhfA26N7rQV
  • MD5 SHA1 SHA512 SSDEEP

  Score

  1^/10
  behavioral2
• • Target
    batch_interpreter.py
  • Size 32KB
  • SHA256 4b6b08f8639487b0f69788419f404a2f60b8f3f4327fef928f2fbefeb14c6be4
  • MD5 0da4aeafc919996d9221df4a5750f6eb
  • SHA1 feef7d942ddb9659175f47dfad77cd909abc0b23
  • SHA512 0a5e2bbdeb2778469b5fa2b21a298ca6392783b4cd822a9f2cb3af454023fbfaa2a2517e556ef1bd900475a2e73afd71cdea9dca40681f093b04c5b74af010ac
  • SSDEEP 768:9PdsvDKnuqmiZFHFXohle4DrJr41HKKzQ5d:JfVuLh41HJC
  • MD5 SHA1 SHA512 SSDEEP

  Score

  3^/10
  behavioral3