xenarmor | bb86852cf19f43f30561b6deb1f31735bebe157fcecdc74f5b7ba453c253b367

General

Target

a.exe
Size

85KB
Sample

231130-1m6gcsbb94
MD5

f4fdac362f860520d28385d92c288a7c
SHA1

9d7add3ef8a94821eff53b9f3b6634a204248a08
SHA256

bb86852cf19f43f30561b6deb1f31735bebe157fcecdc74f5b7ba453c253b367
SHA512

097c06c9ae982308bd80be0d4d9c4bf439005f18861c49d662482dd30acdb52ca413e332e65899d5c058df681185cf0ce4bbf6e7a2ac40de75ed2cd4ba2acf6c
SSDEEP

1536:tKC9T1+3phJnoHt3DU5zPHTLSG/raJtVfNfsCZU8rzfBPgH+U391ChsndEg3:tG/1HTba0ClXR8AsnP

Score

10^/10

Malware Config

Extracted

Family

xworm

C2

goofyah-26004.portmap.host:26004

Attributes

Install_directory
%AppData%
install_file
GVClientV4.exe

Targets

- Target
  
  a.exe
- Size
  
  85KB
- MD5
  
  f4fdac362f860520d28385d92c288a7c
- SHA1
  
  9d7add3ef8a94821eff53b9f3b6634a204248a08
- SHA256
  
  bb86852cf19f43f30561b6deb1f31735bebe157fcecdc74f5b7ba453c253b367
- SHA512
  
  097c06c9ae982308bd80be0d4d9c4bf439005f18861c49d662482dd30acdb52ca413e332e65899d5c058df681185cf0ce4bbf6e7a2ac40de75ed2cd4ba2acf6c
- SSDEEP
  
  1536:tKC9T1+3phJnoHt3DU5zPHTLSG/raJtVfNfsCZU8rzfBPgH+U391ChsndEg3:tG/1HTba0ClXR8AsnP
Score

10^/10

xenarmor xworm collection evasion password persistence rat recovery spyware stealer trojan upx
- Contains code to disable Windows Defender
  A .NET executable tasked with disabling Windows Defender capabilities such as realtime monitoring, blocking at first seen, etc.
- Detect Xworm Payload
- XenArmor Suite
  XenArmor is as suite of password recovery tools for various application.
  recovery password xenarmor
- Xworm
  Xworm is a remote access trojan written in C#.
  trojan rat xworm
- Disables RegEdit via registry modification
  evasion
- Disables Task Manager via registry modification
  evasion
- ACProtect 1.3x - 1.4x DLL software
  Detects file using ACProtect software.
- Drops startup file
- Executes dropped EXE
- Loads dropped DLL
- Reads data files stored by FTP clients
  Tries to access configuration files associated with programs like FileZilla.
  spyware stealer
- Reads local data of messenger clients
  Infostealers often target stored data of messaging applications, which can include saved credentials and account information.
  spyware stealer
- Reads user/profile data of local email clients
  Email clients store some user data on disk where infostealers will often target it.
  spyware stealer
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- UPX packed file
  Detects executables packed with UPX/modified UPX open source packer.
  upx
- Accesses Microsoft Outlook accounts
  collection
- Adds Run key to start application
  persistence
- Looks up external IP address via web service
  Uses a legitimate IP lookup service to find the infected system's external IP.
behavioral1