Extracted

• • Target
    SECURE BYTE GUI.exe
  • Size 9.7MB
  • SHA256 90c2655130733bc1680627754c107c9d8cfd033df0ff40613868e027125b2981
  • MD5 7d422cc9f11fb105ee11dd00ff43b8ad
  • SHA1 688b78961d938249531980af04a02781d6ea6fa0
  • SHA512 69170cc57af4b0490bee8e72ee588a5c25debb42b450b12e041a41028314b755e786722fc17057b8cac700986e6d55464a89a0c24e64d3eb29c5ca8a9112a8f1
  • SSDEEP 98304:2mzLl2SADPtxo/DEkMx/HUYDGSXr5Y3BPyU2WQ:yDVe/D7MFBGSbO3L2
  • TLSH
    T1B3A6877951CF7227CB6121F2FE03A8EDDA5B75CAA372810876851C96C5CF9C2A478CE1
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  adwarebootkitcollectioncrypterdefense_evasiondiscoveryexecutionxwormhacktoolpackerpersistenceprivilege_escalationratspywaretrojan

  • Detect Xworm Payload

  • Family: Xworm

    Xworm is a remote access trojan written in C#.

    trojanratxworm

  • Boot or Logon Autostart Execution: Active Setup

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

    persistence

  • Command and Scripting Interpreter: PowerShell

    Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

    execution

  • Manipulates Digital Signatures

    Attackers can apply techniques such as changing the registry keys of authenticode & Cryptography to make their binary seem validly signed.

  • Event Triggered Execution: Component Object Model Hijacking

    Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.

    persistenceprivilege_escalation

  • Executes a file named after a Windows system binary

    The file runs from a user directory while carrying the name of an executable that normally only exists in System32.

    defense_evasion

  • Executes dropped EXE

  • Loads dropped DLL

  • Accesses Microsoft Outlook profiles

    collection

  • Adds Run key to start application

    persistence

  • Packer/crypter tool: SecureByte

    SecureByte: an open-source packer/crypter that encrypts payloads and produces obfuscated executables.

    hacktoolpackercrypter

  • Writes to the Master Boot Record (MBR)

    Bootkits write to the MBR to gain persistence at a level below the operating system.

    bootkitpersistence

  • ConfuserEx .NET packer

    Detects ConfuserEx .NET packer.

  • Drops file in System32 directory

  behavioral1