Extracted

• • Target
    XBinderOutput.exe
  • Size 128.9MB
  • SHA256 ccd8ae24720b77dd753288c6bc2105d21a749acf5fdd126b21bb5d146fb52ba4
  • MD5 4fbe0afee51f769ffac398dd086014e2
  • SHA1 9e48377fc2d11fd3f0bcb2066330b5fcf7b04675
  • SHA512 bd125394c05e5c16f5bb16fb09cb955047eb249d4646a0bacdade5147ed6bb68857a9000dc83860c21c1ab8271ae11a63d6dbfeaa84030b58958e74caf383fc1
  • SSDEEP 3145728:c8OG3iUZoPRwAUK8AIMta+iM7xSOJX0YjNWOQY6:7hupj8pqJ7xSOJX08wY
  • TLSH
    T1C65833A537914A22F84CEC7D2B3146A5478187E7233C90CB43DA9B30B7056DFEAF5986
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defense_evasiondiscoveryexecutionpersistenceprivilege_escalationpyinstaller

  • Modifies WinLogon for persistence

    persistence

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery

  • Contacts third-party web service commonly abused for C2

    Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

    discovery

  • Command and Scripting Interpreter: PowerShell

    Using powershell.exe command.

    execution

  • Discovers running processes

    Running process information can be used to identify security tools or plan follow-on actions.

    discovery
  behavioral1behavioral2