Extracted

• • Target
    Client-Boots.exe
  • Size 36KB
  • SHA256 2f00f68dd856606a8515d4b9fb6dbeff61e4d5f90b81f2c82fd91c30556b14ae
  • MD5 564c2c8cbf321bed20bf14777085e016
  • SHA1 0f26a1aae821f66f466d7e015f5ad3cc7523611c
  • SHA512 56433db153d2b110b3ee2c774e5f99ae308ff45bdbb0e9ae462c06f0c9b82bba65f39f3d5e925eb771850a45ffef92a235c08908a7f98e984a991150af71f2d8
  • SSDEEP 768:VQ2A5Unv1+tybbH/UASaKyXbFf9kgOMhT3XPN:i2A5Unv1+oHHMgKyrFf9kgOMtPN
  • TLSH
    T197F24C087BD04226DAFD6FF169B372021674E603D913DB9D0CE859EA6F277C08D153AA
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  xwormrattrojan

  • Detect Xworm Payload

  • Family: Xworm

    Xworm is a remote access trojan written in C#.

    trojanratxworm
  behavioral1behavioral2
• • Target
    Unname-Bootsfps.exe
  • Size 18.5MB
  • SHA256 20dddf2030677bbff03386edbd4249ab38a16ad15decccb063feeb4993c119fa
  • MD5 339f07722b8e1f6365b7dc57a838b0da
  • SHA1 f3c692e5247eef1a44bd3cb064cd4ebb75ded37f
  • SHA512 c538e625befdd13d0cfada3bab9dcb671288e58c7d24e9ffacc65ff2ce6c22dbc81352d876c376996c0e7ee2a3e136279c554dac22bc16a145e12da660e17da4
  • SSDEEP 393216:SAyq9yDUkQn/lyKVWL9eH4QnDxnXShEaOSfvUr5Weq:SAyqgAkQn9LdHDtnyEaOkvUr5WV
  • TLSH
    T1DE173328BBE600D7D0EA123E5D53E55AD9E07C12576182EB0320A7DA3F2B4E89D3D774
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defense_evasiondiscoveryexecutionluna_stealerpersistenceprivilege_escalationspywarestealerupx

  • Family: LunaStealer

    LunaStealer is an infostealer written in Python and packaged with Pyinstaller.

    stealerluna_stealer

  • Command and Scripting Interpreter: PowerShell

    Using powershell.exe command.

    execution

  • Command and Scripting Interpreter: PowerShell

    Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

    execution

  • Disables one or more Microsoft Defender components

    Uses the Powershell Set-MpPreference cmdlet to disable one or more Microsoft Defender components.

    defense_evasion

  • Creates a file in the Startup directory

    A file was written to a Windows startup folder. Files in these directories are executed automatically when a user logs on or an application initializes.

    persistenceprivilege_escalation

  • Disables automatic submission of suspicious files to Microsoft by Windows Defender

    Uses the Powershell Set-MpPreference cmdlet to prevent Windows Defender from automatically sending files to Microsoft for analysis.

    defense_evasion

  • Loads dropped DLL

  • Prevents Microsoft Defender from scanning certain paths by adding an exclusion.

    Uses the Powershell Add-MpPreference cmdlet to exclude paths from being scanned by Microsoft Defender.

    defense_evasion

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Contacts third-party web service commonly abused for C2

    Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

    discovery

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  behavioral3behavioral4