Extracted

• • Target
    Simple Checker.exe
  • Size 24.9MB
  • SHA256 afe46999748f64442631212d001564f04af2526060f914161d25992e619e3802
  • MD5 5909ec156143e7c049bb2c4225f7e84d
  • SHA1 7defb9761982a91fd76aeed19860c7689cb2dac7
  • SHA512 e5717354b216227506dbc7c8cbb03490f8080a17610ed0c5912ca097bf95611cb10a4de017690e655943b60e05a68cb89b91cddac3f56e298fed5fe9c1659811
  • SSDEEP 786432:YxVHh/IOUMJl0Fm9YxLrJGzzWK7xdXPX:YxVHaOUMJ6Fmu5iLX
  • TLSH
    T1F047235A288C526CC0D1D230D60A7EEDE1E5F9784D391C1A7FCE1E607E3BD45C4A7A2A
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  6^/10

  defense_evasiondiscoverytrojan

  • Checks whether UAC is enabled

    defense_evasiontrojan

  • Network Share Discovery

    Attempt to gather information on host network.

    discovery

  • Suspicious use of NtSetInformationThreadHideFromDebugger

    defense_evasion
  behavioral1behavioral2
• • Target
    skyline.dll
  • Size 16.5MB
  • SHA256 ee164a9ea084d7a775df11b694ecdaffa3fb3ab0a4f1edf718c8c726d01d07dc
  • MD5 d9197f72448601dabbd58dbe29ba0de5
  • SHA1 c09440596d5fd294c03e3a89f5f260a880b0f2c3
  • SHA512 fd3131a4370308e60eef5ffd81829fa1ae852e6fdf4e653687a0bef2d1730d078a63fca57755f1ff5d03232d52aff06e85c524f1a4ea35171bf8cba47dcc5a44
  • SSDEEP 393216:yw9EQ4S+Nv9f+aphnvhWlrwbt85x6sA8LZ2:ymEI+NvJ+c4lyuL61
  • TLSH
    T14A0723D379D5E1E8C4C79B005AC72BC920E5B28A91FE9A1E3ACB5C033530E57CD4A976
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  5^/10

  defense_evasiondiscovery

  • Suspicious use of NtSetInformationThreadHideFromDebugger

    defense_evasion
  behavioral3behavioral4
• • Target
    skylineloader.exe
  • Size 13.6MB
  • SHA256 5446dd5b5d80fd30775d77aeb8608bd4e0e4725ebcadde71b615cc5bd4eae97d
  • MD5 8cf1b9f79d434286313b865b15e4e1fa
  • SHA1 f80a3902d63250d0b32f1879fcb5a70a601ecebb
  • SHA512 d401c49331baa5e187d231df45e8bef2134311b367c4d90ef9473d7651d082c12b145eb49756837c65d3415f63030e2c66bb157a62e34eb430832fa9388de200
  • SSDEEP 393216:c6vU00++qrcOvMu/+xZMsrqUrw6rRBjsywUJkuRn0GV1l8HvHME:c6vU00cpvIZAU8qRWgJtn0S1l8P
  • TLSH
    T11CE633B4916D4BA9E93A3C79A221E330D8451C529C06F54D64CA7E07BCF3D977C8B8B2
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defense_evasiondiscoveryexecutionxwormpersistenceprivilege_escalationrattrojan

  • Detect Xworm Payload

  • Family: Xworm

    Xworm is a remote access trojan written in C#.

    trojanratxworm

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Creates a file in the Startup directory

    A file was written to a Windows startup folder. Files in these directories are executed automatically when a user logs on or an application initializes.

    persistenceprivilege_escalation

  • Executes dropped EXE

  • Adds Run key to start application

    persistence

  • Suspicious use of NtSetInformationThreadHideFromDebugger

    defense_evasion
  behavioral5behavioral6
• • Target
    w64ms.exe
  • Size 26.2MB
  • SHA256 30baaf04f06726e3a6f59c2fe1ad02400aeb7725d6f5cb429a357a9d77cbd24f
  • MD5 890201956abbc6e3ddd213f337193f74
  • SHA1 e1996d518e2d16fa35b9493458c0814e12e7d4ba
  • SHA512 a8735447d1e1e8ea0ed94b7d29d2c88ee45d731805b9994c26fa23f9f41c35f7ee324d25099b35e82e4dbb503593f39f4db73a0d7d8c5d6e74b1914181a5cd1c
  • SSDEEP 393216:5RCYlDOveP1jAPMS2rYxCwdq1B7QzCQFHsOutn7UpMQFXXp/q8nlbRO4Y:TCWceP1jAU50Cwg1+zpZ6ncMQFJd3
  • TLSH
    T10D57339806B156A3EEA5B13945B3C2B3A232BC505B52844F4BD87EE73D770E10E3A7D1
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  7^/10

  discovery

  • Loads dropped DLL

  behavioral7behavioral8
• • Target
    w64ms.py
  • Size 4.8MB
  • SHA256 7cb302b223b3e8abbe31ca48bc66e14c906fc2e39ea5b41b1fa4e7d7872f1feb
  • MD5 057f9f92323eeaa35d1ec241da8579fb
  • SHA1 56f5c1f093dc08971f33ad23c690ca5a78072166
  • SHA512 8e58518c02f7da2dd98c2a979fdc92bb5c832a31d969e02c9eaae5e119f5991eb31f5796674037f153c7456ec2497cf864db76f88fba1f5c91545681ceec2d1c
  • SSDEEP 768:bTQMASgCyi0Ds/Dl6xfkdZ1JmFz+yxREcqrLQ0lPEwme6a1N9dgjHlh06oTpge13:9
  • TLSH
    T161366BDA1E8CDAB8C76FA464844F9D4BD78E931E221FD540A7EF2E463527C6870B94C0
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  3^/10

  execution
  behavioral10behavioral9