Extracted

• • Target
    SirHurtV5Crack.exe
  • Size 27.6MB
  • SHA256 a020b961adf0ae3232b5a8997f21b8945a35a420ecb8c8a77e2691349d43bfff
  • MD5 a1a8e922765a849cb6851c44ceaa8207
  • SHA1 049b9eb4187b27bef2475e02734bbac5451982d6
  • SHA512 efe80ab8c54ead4cd42d77bba17665e3dcf2400f9b560070e1592f15fc59950343c6bfa361c63e2376a4cc54cd39375dc2843596fa282acffa350a5ce57d314e
  • SSDEEP 786432:V9HcDF/+R7JBuRo1lWiJ8cYlBNZSTH+dcuYmQV6MByNiR:7EG91UmGNZSTHW1YmxMBp
  • TLSH
    T148573351F9EA5833D6B40C330EB66770673E8C307B256EE75B65AB0F69060D181BCD2A
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  discoveryexecutionxwormpersistenceprivilege_escalationrattrojan

  • Detect Xworm Payload

  • Family: Xworm

    Xworm is a remote access trojan written in C#.

    trojanratxworm

  • Command and Scripting Interpreter: PowerShell

    Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

    execution

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Creates a file in the Startup directory

    A file was written to a Windows startup folder. Files in these directories are executed automatically when a user logs on or an application initializes.

    persistenceprivilege_escalation

  • Executes dropped EXE

  • Adds Run key to start application

    persistence

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

    discovery

  • Maps connected drives based on registry

    Disk information is often read in order to detect sandboxing environments.

  behavioral1behavioral2