xenarmor | be15293b42ddc2b13e6cb4316abb5a405c40f9eeb277ff0aedd284124e980298

General

Target

XClient.exe
Size

33KB
Sample

240206-rdq6msgfg9
MD5

b1464f91ed72f58762070a2156a0e051
SHA1

24a5bda03c3a18918a3343a88f3231fdb5c5dea4
SHA256

be15293b42ddc2b13e6cb4316abb5a405c40f9eeb277ff0aedd284124e980298
SHA512

e60ace933853b192548b324ab9b2dd89a40396c6fba246ca1d251f6bdcef6a37d9484c03bed1abdab46220a99c34793445b732e807f671ddc0ebab00e6aa7046
SSDEEP

384:kl+PkjD9+E5MFs7iui8L7zKM42pfL3iB7OxVqWFiRApkFXBLTsOZwpGN2v99IkuV:Q+CD93W03v42JiB70SVF49jBOjhmbw

Score

10^/10

Malware Config

Extracted

Family

xworm

Version

5.0

C2

noiphabibi.ddns.net:1177

Mutex

uPpCa0dXygiTwFxX

Attributes

install_file
USB.exe

aes.plain

Targets

- Target
  
  XClient.exe
- Size
  
  33KB
- MD5
  
  b1464f91ed72f58762070a2156a0e051
- SHA1
  
  24a5bda03c3a18918a3343a88f3231fdb5c5dea4
- SHA256
  
  be15293b42ddc2b13e6cb4316abb5a405c40f9eeb277ff0aedd284124e980298
- SHA512
  
  e60ace933853b192548b324ab9b2dd89a40396c6fba246ca1d251f6bdcef6a37d9484c03bed1abdab46220a99c34793445b732e807f671ddc0ebab00e6aa7046
- SSDEEP
  
  384:kl+PkjD9+E5MFs7iui8L7zKM42pfL3iB7OxVqWFiRApkFXBLTsOZwpGN2v99IkuV:Q+CD93W03v42JiB70SVF49jBOjhmbw
Score

10^/10

xworm rat trojan xenarmor collection evasion password ransomware recovery spyware stealer upx
- Contains code to disable Windows Defender
  A .NET executable tasked with disabling Windows Defender capabilities such as realtime monitoring, blocking at first seen, etc.
- Detect Xworm Payload
- Modifies Windows Defender Real-time Protection settings
  evasion trojan
- Suspicious use of NtCreateUserProcessOtherParentProcess
- XenArmor Suite
  XenArmor is as suite of password recovery tools for various application.
  recovery password xenarmor
- Xworm
  Xworm is a remote access trojan written in C#.
  trojan rat xworm
- ACProtect 1.3x - 1.4x DLL software
  Detects file using ACProtect software.
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE
- Loads dropped DLL
- Reads data files stored by FTP clients
  Tries to access configuration files associated with programs like FileZilla.
  spyware stealer
- Reads local data of messenger clients
  Infostealers often target stored data of messaging applications, which can include saved credentials and account information.
  spyware stealer
- Reads user/profile data of local email clients
  Email clients store some user data on disk where infostealers will often target it.
  spyware stealer
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- UPX packed file
  Detects executables packed with UPX/modified UPX open source packer.
  upx
- Accesses Microsoft Outlook accounts
  collection
- Sets desktop wallpaper using registry
  ransomware
behavioral1 behavioral2