Extracted

• • Target
    trut emulator.rar
  • Size 1.6MB
  • SHA256 562c77bd14c302bb61c2ce85c6fcb759dd9b5d394f90e363eafffa9db011c367
  • MD5 61ccdf12cc5345e69a5bfd0979144033
  • SHA1 2f736ef165d5f8e5d22e67c49fc5f51603545f22
  • SHA512 2220e8e380da59e477979fc1be8c04288e474aa680f10eedcb98dfb6e81ffb209890a18ff9c0f9846b9c13739784a0c47eacf9bfb66b9ca59bfeafb5413e724e
  • SSDEEP 49152:2OdsJbh+sMdu0itwWGpWUIHDR9N2PtcLTh:2O+JbhnFt0pWDRPktK
  • TLSH
    T18D75331479D373796BADF0A6308C08895DB4D8D066598F3784A12F3FC369162BB4E787
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  1^/10
  behavioral1behavioral2behavioral3
• • Target
    test.exe
  • Size 39KB
  • SHA256 bc38c0e870126e751176393615cf548ea2df1a44f3911f0a5cf4a1408c29b379
  • MD5 66f9a01356d9463e2f157ef56d92ace6
  • SHA1 6be829d95514ff49ac6a6f52a18624871239154c
  • SHA512 24d9facf368a598f9f720954448275f89d55c79ff7d7fc21f9f1099d037ab9d2d5877edaadb6aa275f35b89cb3df3a123cc634e8c909e6e7a29ca389a189fd43
  • SSDEEP 768:+RP8pEtSvcfKmv7oOMtw0/3PjF5Ph9Cxxg6+OwhgICpHIgcS:sPh0vcREuWbFD98xg6+Ow5Mos
  • TLSH
    T121034B883BF48216D4FF6BF929B3A2060734E6139D23DB5E4CD8456A2B67BC189413D7
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  xwormrattrojanexecutionpersistence

  • Detect Xworm Payload

  • Xworm

    Xworm is a remote access trojan written in C#.

    trojanratxworm

  • Xworm family

    xworm

  • Command and Scripting Interpreter: PowerShell

    Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

    execution

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Drops startup file

  • Executes dropped EXE

  • Adds Run key to start application

    persistence

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  behavioral4behavioral5behavioral6
• • Target
    text.exe
  • Size 39KB
  • SHA256 d628fa5dbbf7e65583a2577b15db6415550fd2a47df471afb3b00247f5f7a438
  • MD5 0c24ab50a053fe15d6abb55f66442cf2
  • SHA1 09dd4d9ece176527a6884b9480b06f642e34ea3f
  • SHA512 3b2e81a2cd2c939ffc99da959bc8531393626b22a400867d4ad0c1044a0c669bbc69b1a5ad2fe4898c97a9bd1a5ef5ad8cff3dbdf6f8cc2cfe9ee4f056da44d5
  • SSDEEP 768:8RP8pEtSvcfKmvDZOMtw0/f2jF5Ph9Cxq6+OwhXICpHIgc5:CPh0vcRluWKFD98q6+OwmMov
  • TLSH
    T1C5034A883BF48215D4FF6BF929B2A2020774E6139D23DB5F4CD8456A2B67BC18A413D7
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  executionxwormpersistencerattrojan

  • Detect Xworm Payload

  • Xworm

    Xworm is a remote access trojan written in C#.

    trojanratxworm

  • Xworm family

    xworm

  • Command and Scripting Interpreter: PowerShell

    Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

    execution

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Drops startup file

  • Executes dropped EXE

  • Adds Run key to start application

    persistence

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  behavioral7behavioral8behavioral9
• • Target
    trut emulator/trut emulator.exe
  • Size 1.8MB
  • SHA256 3bcf9be0e623ddf9d887e238ed135179b7177e487294a7e32c5b38189fa63213
  • MD5 9c095f4694cd89cbac883bf6c1004701
  • SHA1 d217feb8cf2f248a3f6646b9e9c92d29c6ece7fb
  • SHA512 fc746a37894a279e5edfdda66e8caeea8c7a278a156c8781a495a5597ce488054fddaec61bf00cbe1a8acbe15b86188864771cf18188bca267493882690b29bf
  • SSDEEP 49152:a3Gyl6+MjPX2OeVZ7mDMIqZElKeKQicu:6o1j/2pFwMeJu
  • TLSH
    T13795332591698735C49803F5289D9A626B623FC750F1C637DC09BECB7AB7B08E0B1877
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  3^/10

  discovery
  behavioral10behavioral11behavioral12