xenarmor | e9f625a7fef461cc7ead529e65de731d1c763ad0eb7dcb2e0ded65ee6a8cad8c

General

Target

ttG.exe
Size

319KB
Sample

240321-2ec1hsca95
MD5

3d8e131c16526bb4a2b103eae1ebb710
SHA1

544ac7db4642616d6c140d57e2da3d9964d4d9fa
SHA256

e9f625a7fef461cc7ead529e65de731d1c763ad0eb7dcb2e0ded65ee6a8cad8c
SHA512

e03238edce82944e9994e38f8dc70e442783b3c80cf6371e489df462a38a437387ff35e09214244cd1ae239a673d3812d2d4b622c73885e9c4927322996988e7
SSDEEP

6144:8dGKSNbQ+GIIIIIIIhIIIIIIIIIIIIIIIU:cq

Score

10^/10

Malware Config

Extracted

Family

xworm

C2

outside-wilson.gl.at.ply.gg:3991

Attributes

Install_directory
%AppData%
install_file
USB.exe

Targets

- Target
  
  ttG.exe
- Size
  
  319KB
- MD5
  
  3d8e131c16526bb4a2b103eae1ebb710
- SHA1
  
  544ac7db4642616d6c140d57e2da3d9964d4d9fa
- SHA256
  
  e9f625a7fef461cc7ead529e65de731d1c763ad0eb7dcb2e0ded65ee6a8cad8c
- SHA512
  
  e03238edce82944e9994e38f8dc70e442783b3c80cf6371e489df462a38a437387ff35e09214244cd1ae239a673d3812d2d4b622c73885e9c4927322996988e7
- SSDEEP
  
  6144:8dGKSNbQ+GIIIIIIIhIIIIIIIIIIIIIIIU:cq
Score

10^/10

xenarmor xworm collection password ransomware rat recovery spyware stealer trojan upx
- Contains code to disable Windows Defender
  A .NET executable tasked with disabling Windows Defender capabilities such as realtime monitoring, blocking at first seen, etc.
- Detect Xworm Payload
- XenArmor Suite
  XenArmor is as suite of password recovery tools for various application.
  recovery password xenarmor
- Xworm
  Xworm is a remote access trojan written in C#.
  trojan rat xworm
- ACProtect 1.3x - 1.4x DLL software
  Detects file using ACProtect software.
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Drops startup file
- Executes dropped EXE
- Loads dropped DLL
- Reads WinSCP keys stored on the system
  Tries to access WinSCP stored sessions.
  spyware stealer
- Reads data files stored by FTP clients
  Tries to access configuration files associated with programs like FileZilla.
  spyware stealer
- Reads local data of messenger clients
  Infostealers often target stored data of messaging applications, which can include saved credentials and account information.
  spyware stealer
- Reads user/profile data of local email clients
  Email clients store some user data on disk where infostealers will often target it.
  spyware stealer
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- UPX packed file
  Detects executables packed with UPX/modified UPX open source packer.
  upx
- Accesses Microsoft Outlook accounts
  collection
- Drops desktop.ini file(s)
- Sets desktop wallpaper using registry
  ransomware
behavioral1