Extracted

• • Target
    Client-bootsfps.exe
  • Size 77KB
  • SHA256 faeca555b613c71cf015a37f8201c9e15daacef119b7c8a383b4b2cb86704db5
  • MD5 d4a73ed495eeed0e699756740946c7f8
  • SHA1 96daf3787e8397ab2fe4da59e7f82f4b3b604ad6
  • SHA512 51b545d7e325067874976af06d5d5ef016cc9ce146ea092cd8cc5ba7c7b763b78097a687c6b422cb8cfd904b88464c2033bbee0da44a070b9fb8342c736bd3d6
  • SSDEEP 1536:X00qiwaxJLjqxrHYhbX+x1/Jq6Z9hWO7DPTQG31:X08qVYhbuxxWOvP8GF
  • TLSH
    T1FA737C683BE50117F0FE6FB09DF177128638B7236903DA5FB4D902CA1A2B985CD416E9
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  discoveryexecutionxwormpersistenceprivilege_escalationrattrojan

  • Detect Xworm Payload

  • Family: Xworm

    Xworm is a remote access trojan written in C#.

    trojanratxworm

  • Command and Scripting Interpreter: PowerShell

    Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

    execution

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Creates a file in the Startup directory

    A file was written to a Windows startup folder. Files in these directories are executed automatically when a user logs on or an application initializes.

    persistenceprivilege_escalation

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

    discovery
  behavioral1behavioral2
• • Target
    Unname-Bootsfps.exe
  • Size 18.5MB
  • SHA256 20dddf2030677bbff03386edbd4249ab38a16ad15decccb063feeb4993c119fa
  • MD5 339f07722b8e1f6365b7dc57a838b0da
  • SHA1 f3c692e5247eef1a44bd3cb064cd4ebb75ded37f
  • SHA512 c538e625befdd13d0cfada3bab9dcb671288e58c7d24e9ffacc65ff2ce6c22dbc81352d876c376996c0e7ee2a3e136279c554dac22bc16a145e12da660e17da4
  • SSDEEP 393216:SAyq9yDUkQn/lyKVWL9eH4QnDxnXShEaOSfvUr5Weq:SAyqgAkQn9LdHDtnyEaOkvUr5WV
  • TLSH
    T1DE173328BBE600D7D0EA123E5D53E55AD9E07C12576182EB0320A7DA3F2B4E89D3D774
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defense_evasiondiscoveryexecutionluna_stealerpersistenceprivilege_escalationspywarestealerupx

  • Family: LunaStealer

    LunaStealer is an infostealer written in Python and packaged with Pyinstaller.

    stealerluna_stealer

  • Command and Scripting Interpreter: PowerShell

    Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

    execution

  • Disables one or more Microsoft Defender components

    Uses the Powershell Set-MpPreference cmdlet to disable one or more Microsoft Defender components.

    defense_evasion

  • Creates a file in the Startup directory

    A file was written to a Windows startup folder. Files in these directories are executed automatically when a user logs on or an application initializes.

    persistenceprivilege_escalation

  • Disables automatic submission of suspicious files to Microsoft by Windows Defender

    Uses the Powershell Set-MpPreference cmdlet to prevent Windows Defender from automatically sending files to Microsoft for analysis.

    defense_evasion

  • Loads dropped DLL

  • Prevents Microsoft Defender from scanning certain paths by adding an exclusion.

    Uses the Powershell Add-MpPreference cmdlet to exclude paths from being scanned by Microsoft Defender.

    defense_evasion

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Contacts third-party web service commonly abused for C2

    Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

    discovery

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  behavioral3behavioral4