Extracted

• • Target
    174047faedae187b42c666c6c34ba1fdb1791b16f1c63f6bd2258fbd6409b77a.exe
  • Size 402KB
  • SHA256 174047faedae187b42c666c6c34ba1fdb1791b16f1c63f6bd2258fbd6409b77a
  • MD5 05303a7d2a6b9a8672abaa23abf2c99c
  • SHA1 6c7c555a55f3b3d7b58c71f6ecb8df87e9296a06
  • SHA512 8402dc6f418451b3b832e367ddf35758e7b10ca2e3c59d1057cb736a134ed9d5a86f85a4a726b5fbcd77fc764da6862c803eec8ed4b518c4491f54df8e5fbaea
  • SSDEEP 6144:Jwq3Nplp8rtzZ3vxjmMAQFEY86jgGf5LYR1tQ73cnfU71437AU4asFS7kq9DCfQz:JzhufPAgEYFVLaFkqooa4F8LW/cQ5
  • TLSH
    T1F294BF423D0CA8D7ED3D2372296785862FB474BA4B92169F7AAFF65648023034E1FD5C
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  discoverydownloaderguloaderxwormpersistencerattrojan

  • Detect Xworm Payload

  • Family: Guloader,Cloudeye

    A shellcode based downloader first seen in 2020.

    downloaderguloader

  • Family: Xworm

    Xworm is a remote access trojan written in C#.

    trojanratxworm

  • Loads dropped DLL

  • Adds Run key to start application

    persistence

  • Suspicious use of NtCreateThreadExHideFromDebugger

  • Suspicious use of NtSetInformationThreadHideFromDebugger

  behavioral1behavioral2
• • Target
    $PLUGINSDIR/System.dll
  • Size 11KB
  • SHA256 bd046e6497b304e4ea4ab102cab2b1f94ce09bde0eebba4c59942a732679e4eb
  • MD5 17ed1c86bd67e78ade4712be48a7d2bd
  • SHA1 1cc9fe86d6d6030b4dae45ecddce5907991c01a0
  • SHA512 0cbed521e7d6d1f85977b3f7d3ca7ac34e1b5495b69fd8c7bfa1a846baf53b0ecd06fe1ad02a3599082ffacaf8c71a3bb4e32dec05f8e24859d736b828092cd5
  • SSDEEP 192:eY24sihno00Wfl97nH6T2enXwWobpWBTU4VtHT7dmN35Ol+Sl:E8QIl975eXqlWBrz7YLOl+
  • TLSH
    T1E3325C12135081F3E4918138C86B3A276B6A15029BF98E57DFD39546BE31BE3BD7D603
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  3^/10

  discovery
  behavioral3behavioral4