Extracted

• • Target
    17178602463c6b4cdf436b48ec4c5dbc6aee5ae0da7ee001e248c7e98692d8d99ecd71b334854.dat-decoded.exe
  • Size 34KB
  • SHA256 9c33e83331c4e2e954f355f453bd32add84016d45e6434d568fb56b690de26ce
  • MD5 63e46b6425db8622626f0094a49fc323
  • SHA1 fedfcddc9659ec171f40661ad7e375af9be071cc
  • SHA512 7af3aa00041ec7a77abc45624973b24b747539c3fd8ecefbadc0fc7191d7cd18735a7f77b3f55cfa14d702c6c237722662daa5f4dbdece4f442e4bc41443e807
  • SSDEEP 768:N4fK1pDGkptwyZScCBSUapNgqtRU/kZB+Bcg4tlTF5923UO9hASURJ:NDGkptwyZScCkU4rPUsZIB54HF592kOe
  • MD5 SHA1 SHA512 SSDEEP

  Score

  10^/10

  xwormexecutionrattrojanpersistencespywarestealer

  • Detect Xworm Payload

  • Xworm

    Xworm is a remote access trojan written in C#.

    trojanratxworm

  • Blocklisted process makes network request

  • Command and Scripting Interpreter: PowerShell

    Run Powershell and hide display window.

    execution

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Adds Run key to start application

    persistence

  • Suspicious use of SetThreadContext

  behavioral1behavioral2