Extracted

• • Target
    SECURE BYTE GUI.exe
  • Size 9.7MB
  • SHA256 90c2655130733bc1680627754c107c9d8cfd033df0ff40613868e027125b2981
  • MD5 7d422cc9f11fb105ee11dd00ff43b8ad
  • SHA1 688b78961d938249531980af04a02781d6ea6fa0
  • SHA512 69170cc57af4b0490bee8e72ee588a5c25debb42b450b12e041a41028314b755e786722fc17057b8cac700986e6d55464a89a0c24e64d3eb29c5ca8a9112a8f1
  • SSDEEP 98304:2mzLl2SADPtxo/DEkMx/HUYDGSXr5Y3BPyU2WQ:yDVe/D7MFBGSbO3L2
  • TLSH
    T1B3A6877951CF7227CB6121F2FE03A8EDDA5B75CAA372810876851C96C5CF9C2A478CE1
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  crypterdefense_evasiondiscoveryexecutionxwormhacktoolpackerpersistencerattrojan

  • Detect Xworm Payload

  • Family: Xworm

    Xworm is a remote access trojan written in C#.

    trojanratxworm

  • Command and Scripting Interpreter: PowerShell

    Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

    execution

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes a file named after a Windows system binary

    The file runs from a user directory while carrying the name of an executable that normally only exists in System32.

    defense_evasion

  • Executes dropped EXE

  • Loads dropped DLL

  • Packer/crypter tool: SecureByte

    SecureByte: an open-source packer/crypter that encrypts payloads and produces obfuscated executables.

    hacktoolpackercrypter

  • ConfuserEx .NET packer

    Detects ConfuserEx .NET packer.

  behavioral1