Extracted

Extracted

Extracted

• • Target
    9bddae1f50fbeeba8541ff1c724ba64a249f4afb71400cd31ccffa8540086348
  • Size 5.0MB
  • SHA256 9bddae1f50fbeeba8541ff1c724ba64a249f4afb71400cd31ccffa8540086348
  • MD5 bf9dc07083e331d9645d926fa411427a
  • SHA1 29d67e13e948d215264a3664a1ac77f27f5068b3
  • SHA512 83a963d4bcbcd06dcff8f2b9082262be90fc94c9bfd74ab90804c37a91990fdb01e612bfec37054a81e087192c207d7723f7be1adb87e5565dfeae4850066d09
  • SSDEEP 98304:VkkrdjULdfay+4DloEjeHxYdSDK6IYVxPcGZApm8paoXUxzN/sFQqy:XdQ9aMFSwYVx1Ame9y
  • TLSH
    T19B363324A90B693DF3FD70F91922A3A6B910C0F7E45B1537E0B6A63D5E03B51C43A4A7
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  spasiba3defense_evasiondiscoveryexecutioncybergatequasarxmrigxwormminerpersistenceratspywarestealertrojanupx

  • Detect Xworm Payload

  • Family: CyberGate, Rebhip

    CyberGate is a lightweight remote administration tool with a wide array of functionalities.

    trojanstealercybergate

  • Family: Quasar RAT

    Quasar is an open source Remote Access Tool.

    trojanspywarequasar

  • Family: Xworm

    Xworm is a remote access trojan written in C#.

    trojanratxworm

  • Family: xmrig

    XMRig is a high performance, open source, cross platform CPU/GPU miner.

    minerxmrig

  • Quasar payload

  • Suspicious use of NtCreateUserProcessOtherParentProcess

  • XMRig Miner payload

    miner

  • Adds policy Run key to start application

    persistence

  • Boot or Logon Autostart Execution: Active Setup

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

    persistence

  • Command and Scripting Interpreter: PowerShell

    Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

    execution

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Creates new service(s)

    persistenceexecution

  • Executes dropped EXE

  • Stops running service(s)

    defense_evasionexecution

  • Adds Run key to start application

    persistence

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

    discovery

  • Power Settings

    powercfg controls all configurable power system settings on a Windows system and can be abused to prevent an infected host from locking or shutting down.

    persistence

  • Drops file in System32 directory

  • Suspicious use of NtSetInformationThreadHideFromDebugger

  • Suspicious use of SetThreadContext

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  behavioral1behavioral2