Extracted

• • Target
    BuLLeT-External-v3.zip
  • Size 6.3MB
  • SHA256 3b54fc30a02f98a4451ee8193b52e899d76a78659f8197230d0c99fac3cd9684
  • MD5 3be70dab8fd8d72bc4ddc89acc2fa3a2
  • SHA1 4bc73de8d1e39fe105b3c1bf7273ebff060c0af3
  • SHA512 45fb1420aff43571fbed3ea6d76f9a34688149cf275711909f3ad492b400814d2d18dd91f3224f76fe4f2128a69591c2acae1ab4dd176c7907e885162ef1297a
  • SSDEEP 98304:rFTcrBmVpH+ET80x3XkrDBgIOCxjZuLMsxko4gbcKhPKZ8AYqFVv1W8GUkfKxXE:Rqy+sVeCcZuPkJK5hAYqF5HjkaXE
  • TLSH
    T178663338F520760CE91A904B45CBC7E23ECBA0316A255BBC0575C760BFD6DA70B1A9F6
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  6^/10

  discovery

  • Enumerates connected drives

    Attempts to read the root path of hard drives other than the default C: drive.

  behavioral1
• • Target
    BuLLeT-External-v3/BuLLeT-External-v3.exe
  • Size 6.8MB
  • SHA256 048b18385b9a3498523f64a74738ac768e615a3d6dd4baeb65da86ff7e38adcf
  • MD5 bdedfa7e8922e703c2d2bb29f115e658
  • SHA1 aa16b0f0d14ec9d111eed187296934fff142565b
  • SHA512 a6aad4da330cf91cc6473336ee26a9dd3e772b83039e2ea74c560a35857810e9b728cae457144b702fa6c40f90b7b98735596c73b2268f9dfd13bd61d3c147da
  • SSDEEP 98304:Gcds3KwXLOvCcFXHchWTdbN4AtRTp0Ca/AMxSpKArnKBkOLd8qUWNQRMt:GcdsavCUTFNxtxYAmstrnwLLUWua
  • TLSH
    T14F66114781E5A1EEE6F6F53369727B44894001C6CB1EEB777270A27736074369E88C3A
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defense_evasiondiscoveryexecutionxwormpersistenceprivilege_escalationrattrojan

  • Detect Xworm Payload

  • Family: Xworm

    Xworm is a remote access trojan written in C#.

    trojanratxworm

  • Command and Scripting Interpreter: PowerShell

    Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

    execution

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Creates a file in the Startup directory

    A file was written to a Windows startup folder. Files in these directories are executed automatically when a user logs on or an application initializes.

    persistenceprivilege_escalation

  • Executes dropped EXE

  • Adds Run key to start application

    persistence
  behavioral2