Extracted

• • Target
    SECURE BYTE GUL.exe
  • Size 2.9MB
  • SHA256 6438f9f8e2bae1a81ac9b588aa04d0f8d7dae6671113f1c91f4ccfd6d4398479
  • MD5 c38c22de6745128d4a95249f3b60644c
  • SHA1 ed80124fc67a03b1b8ddb3b76101bcdd34db4f7d
  • SHA512 74ba33a45d93a699218d82583fd767eab204f354b08f89a6c3af8b8945b3dad357b36aaf97907586461be293f1e30581ac9dbf6af99ac78b32f52bc49c3b5417
  • SSDEEP 24576:ZBOIGjLFeHclO6+kZFFL0Juzn1SNNh2oT9OrOVv8atqu7vn:ZBablYSF+uz1SF2oTfVv8mv
  • TLSH
    T128E5F3C1BD0B7339E84321B21E0447070F63D8BC05CBAF96E956EB728A655546AE33ED
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  bootkitcrypterdefense_evasiondiscoveryexecutionxwormhacktoolpackerpersistencerattrojan

  • Detect Xworm Payload

  • Family: Xworm

    Xworm is a remote access trojan written in C#.

    trojanratxworm

  • Command and Scripting Interpreter: PowerShell

    Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

    execution

  • Disables Task Manager via registry modification

    defense_evasion

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes a file named after a Windows system binary

    The file runs from a user directory while carrying the name of an executable that normally only exists in System32.

    defense_evasion

  • Executes dropped EXE

  • Packer/crypter tool: SecureByte

    SecureByte: an open-source packer/crypter that encrypts payloads and produces obfuscated executables.

    hacktoolpackercrypter

  • Writes to the Master Boot Record (MBR)

    Bootkits write to the MBR to gain persistence at a level below the operating system.

    bootkitpersistence

  • Drops file in System32 directory

  behavioral1