Extracted

• • Target
    revoltlast.7z
  • Size 2.1MB
  • SHA256 bc106d8299a6dfc259d9eb3c940db6a231c7dd440f24656706ab3f832801da6e
  • MD5 58351aab86607c1fe7db2ae460a7b032
  • SHA1 21ed30e2f3fbfd02b6a7bb80bf3a9799652aebbb
  • SHA512 f81810e878be4141b9e09fd4fe83e75efb9a02e5751fa1f1522f597a7b40df7079d4181a251bf4f66c6ccf41f38127af31b97c2695096240faaa44b047263377
  • SSDEEP 49152:4kod6JPnX4xo6aAKkCPqeqJjNsCPVlkZne//3e4rTkqrBbZjD2:zYOoxEACyeqJjtPVlkFLokqrdd6
  • TLSH
    T16EA5336541D63B0BE30C8644D6AA31EC7AA9CB2CE17ECA310A5EA1DF4627D11C1F51EB
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  discoveryexecutionxwormpersistencerattrojan

  • Detect Xworm Payload

  • Xworm

    Xworm is a remote access trojan written in C#.

    trojanratxworm

  • Xworm family

    xworm

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Drops startup file

  • Executes dropped EXE

  • Adds Run key to start application

    persistence

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  behavioral1behavioral2
• • Target
    Guna.UI2.dll
  • Size 2.1MB
  • SHA256 e658e8a5616245dbe655e194b59f1bb704aaeafbd0925d6eebbe70555a638cdd
  • MD5 c97f23b52087cfa97985f784ea83498f
  • SHA1 d364618bec9cd6f8f5d4c24d3cc0f4c1a8e06b89
  • SHA512 ecfa83596f99afde9758d1142ff8b510a090cba6f42ba6fda8ca5e0520b658943ad85829a07bf17411e26e58432b74f05356f7eaeb3949a8834faa5de1a4f512
  • SSDEEP 49152:cvrqKk8q2gqi2OXCt6kuSw9g8PTNTN/23uxjPHEiCAjFcm:cvrqZr
  • TLSH
    T16EA50A197DD4EE27D16ACE33D6D25021E3F1E4932AB2EB0E72D357681842349788637E
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  1^/10
  behavioral3behavioral4
• • Target
    RevoltLastversionexe.exe
  • Size 1.7MB
  • SHA256 52fcd3794f016870662b5e057a97656edf3631e939417f0427fdacf1ea7958de
  • MD5 6d4dc5e6465f77ee03617813fab9199e
  • SHA1 51140f5c07130330649f110fe133196c220c4526
  • SHA512 fbd2fa85ac5378b290efacefb4ba2e3e7980ae1667b2f5412c7fc6d8aa82b448c91dec8e504d2bbc022812e434d69f090ea5c1154d8e7166fa34564d3746e1a4
  • SSDEEP 49152:U7e1Me1/4wL0Vl9hrelL32wNgdsrj1ZjTw:VD/50Vl9tN7dsrJdTw
  • TLSH
    T11F85236307F5B641E39E8574AAB5708D6EF5E924CA3ECD373198E21E07A540092F12EF
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  discoveryexecutionxwormpersistencerattrojan

  • Detect Xworm Payload

  • Xworm

    Xworm is a remote access trojan written in C#.

    trojanratxworm

  • Xworm family

    xworm

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Drops startup file

  • Executes dropped EXE

  • Adds Run key to start application

    persistence

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  behavioral5behavioral6