Extracted

• • Target

    XWorm V3.0.exe

  • Size

    8.1MB

  • MD5

    06a5c65502a55e3f91f49cd7a6a6740d

  • SHA1

    b2318b72ab7b098e459baa291cf286519d798546

  • SHA256

    722ff7d4d145e71884c901b846c19c727a557c493238cdf337c37fc118a2d377

  • SHA512

    13b434406c88ae9c27d13dbb7f676f14e80713247a8e7e2d03ccb00021f0206a9b3d1f7705dd907c5e38740d4ab66822f8c64234040ee91fb9e931234a55924c

  • SSDEEP

    196608:XV7FB3fwHcBInMmML22ONosVDor3hCOcls0maMh7K3qx9:F7FBPwlnC2DMrE32thaqx9

  Score

  10^/10

  neshtaxwormpersistenceratspywarestealertrojan

  • Detect Neshta payload

  • Modifies system executable filetype association

    persistence

  • Neshta

    Malware from the neshta family is designed to infect itself into other files to spread itself and cause damage.

    persistencespywareneshta

  • Xworm

    Xworm is a remote access trojan written in C#.

    trojanratxworm

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Drops startup file

  • Executes dropped EXE

  • Loads dropped DLL

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Adds Run key to start application

    persistence
  behavioral1