Extracted

• • Target
    keygen.exe
  • Size 549KB
  • SHA256 9bb33cd4b853b4272e5fa09142d5aaeb7f72e496f825f194f3102360863b392c
  • MD5 2545d17c0eff1e22b6a0e05542f3f557
  • SHA1 fe2e3da168d57cccbde87cc14e1c69e31ca36de6
  • SHA512 5581db5c0da2714af70da2e0684e4d2565a89df053c9f46106cfb20a29c8f91f01f54fca7f4205f8d14f67a1d1e50bb3bee3b44b5f5c92aa7b88ca7f6ec28b9f
  • SSDEEP 12288:dZVgiVs8GM0PwKWlIRAwcM3TH4FO79I0reh3EMSVq6oSxxxNJJJJJ:fVv6M0PIMjHX/3xxNJJJJJ
  • TLSH
    T15BC423B1708BB44EE053A67C0E88E216B3D6FF914F4359A771AD778F41398828916FC4
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  5^/10

  discoveryupx

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  behavioral1behavioral2
• • Target
    nl brute hitler.exe
  • Size 10.8MB
  • SHA256 c436e5fc08bf5ac14562b6d74136669a1fa891849b5c6680c3ed5cb286a2257a
  • MD5 547130ae13fa988f02771c301a29248f
  • SHA1 da481f8de1aa9f55819559a1084e191caefc3e75
  • SHA512 8dcc852c1e93d93a0eec3925fb45a716db0b10202b146b323d1ec521f30b67ca3854db26dee4761affe50c62be2091a9f5ca32f8c43c26013b366c654a04ed89
  • SSDEEP 196608:7GYWwDkXuoMUqjGDmw7izYzHLkW8/cTISxEU6WB0AuJdNbLK4UCWFm1Q5WhKJo3n:5suoMUqjGBukzLI/Cxd6WB0rBbLKTJFg
  • TLSH
    T1A1B6127FC9A4AD14D9BDD97359B91AD2886868E3373707F810CBA81973BE07C2074C99
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  executionxwormpersistenceprivilege_escalationrattrojan

  • Detect Xworm Payload

  • Family: Xworm

    Xworm is a remote access trojan written in C#.

    trojanratxworm

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Creates a file in the Startup directory

    A file was written to a Windows startup folder. Files in these directories are executed automatically when a user logs on or an application initializes.

    persistenceprivilege_escalation

  • Executes dropped EXE

  • Adds Run key to start application

    persistence
  behavioral3behavioral4