Extracted

• • Target

    Xfnpub_protected.exe

  • Size

    3.4MB

  • MD5

    33b76c675cfddebb043ba6ec18b7bf6d

  • SHA1

    582617d3c14ff7ccd75278b60c87cf87bee51ca0

  • SHA256

    7e538f304d733f1ef18175f7693748645b4425cd4dd3461a494bd45e9e7d75a6

  • SHA512

    1fcd6a9099bbe4485c3fe67140c951771d5f9abcf928c0931b91ee34d2937905bfefd1b0eda1825f0776870a19dc0df6b9724aefd9662fa11d9a1733e77c2f1f

  • SSDEEP

    98304:mYwxP9hSuddhN7S1evZU5RXtCV/UzLnqPgYrb+zD:KzhzJSn0qjqPZbs

  Score

  10^/10

  xwormevasionratthemidatrojanpersistence

  • Detect Xworm Payload

  • Xworm

    Xworm is a remote access trojan written in C#.

    trojanratxworm

  • Identifies VirtualBox via ACPI registry values (likely anti-VM)

    evasion

  • Downloads MZ/PE file

  • Checks BIOS information in registry

    BIOS information is often read in order to detect sandboxing environments.

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Themida packer

    Detects Themida, an advanced Windows software protection system.

    themida

  • Adds Run key to start application

    persistence

  • Checks whether UAC is enabled

    evasiontrojan

  • Legitimate hosting services abused for malware hosting/C2

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Drops file in System32 directory

  • Suspicious use of NtSetInformationThreadHideFromDebugger

  behavioral1behavioral2