Extracted

• • Target
    Prism Release/ByfronHook.dll
  • Size 21KB
  • SHA256 3811858da4b1f5e7f40d1237d7189ddca3989fa0d7b07e87c538f92975b893d2
  • MD5 4e3e92823caeac1203beaa5a35d6dafc
  • SHA1 893b591d46c39e817052cd05ec969fea74da4233
  • SHA512 0490e800f1e5c9b38b6c9b56616290f3a7214179e6d993214e3dd742d44d1d669fe5073b5a121c588c05f3e7c0ec576798236ee94e1a9b37e1d980d1969c9d33
  • SSDEEP 384:pPLl4JbDL8XQZW8LN/4pvuBUyHVz0Ad29DtSLKZR2CF/9+8ADu/TyZdEPLe:pPh4yQZW8LNuAUyJl29DtSLKZR2m9+8m
  • MD5 SHA1 SHA512 SSDEEP

  Score

  1^/10
  behavioral1behavioral2
• • Target
    Prism Release/Prism Release V1.3.exe
  • Size 5.1MB
  • SHA256 af714718f7ad3bcb60321daf63f23e7f2a586903baea8014d5f27dd65d4a9413
  • MD5 7e1841390354f79ea0a211457dded684
  • SHA1 6c500478bd165f741ed469a571b94fd159aa03a0
  • SHA512 6c0f54c9c1e794c3e01d3725bf1c9e654254f6a9068dc287ed7b11ee7abc226307712a62d3ac034e38b993e6e19c12f8593bfbf9cab1c5df4f49123187cc4ca5
  • SSDEEP 98304:LpyqiI/na1r1jg/hNMNNrrpbeRB45YenyHCaCP9iKIA20Fh1SDi3GoYm:Nr/na/OGLrrpqR25FyHCaeXhFyDi3GoY
  • MD5 SHA1 SHA512 SSDEEP

  Score

  10^/10

  xwormexecutionpersistencerattrojanspywarestealer

  • Detect Xworm Payload

  • Xworm

    Xworm is a remote access trojan written in C#.

    trojanratxworm

  • Command and Scripting Interpreter: PowerShell

    Using powershell.exe command.

    execution

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Drops startup file

  • Executes dropped EXE

  • Loads dropped DLL

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Accesses cryptocurrency files/wallets, possible credential harvesting

    spyware

  • Adds Run key to start application

    persistence

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  behavioral3behavioral4
• • Target
    Prism Release/assets.dll
  • Size 171KB
  • SHA256 672cb16128dea50e21fd2d98889e2d6a2264b654304a3f4248ebdf4c546f734a
  • MD5 bcc0b07de0a24f9701fc97d154ecd660
  • SHA1 cb5ba3b790cee940b4d18ff78e5a6cd71bdad47d
  • SHA512 18959767986401bc877d30416e550c55e97c158f674b8f76dc9af117494e65e11d6000521f72be93c193ebd38f84d1b9578386c24911fda97507277f06ebd8e4
  • SSDEEP 3072:rN505WN505WN505WN505WN505WN505WN505WN505WN505m:rNJNJNJNJNJNJNJNJNB
  • MD5 SHA1 SHA512 SSDEEP

  Score

  1^/10
  behavioral5behavioral6
• • Target
    Prism Release/bin/autoattach.dll
  • Size 171KB
  • SHA256 672cb16128dea50e21fd2d98889e2d6a2264b654304a3f4248ebdf4c546f734a
  • MD5 bcc0b07de0a24f9701fc97d154ecd660
  • SHA1 cb5ba3b790cee940b4d18ff78e5a6cd71bdad47d
  • SHA512 18959767986401bc877d30416e550c55e97c158f674b8f76dc9af117494e65e11d6000521f72be93c193ebd38f84d1b9578386c24911fda97507277f06ebd8e4
  • SSDEEP 3072:rN505WN505WN505WN505WN505WN505WN505WN505WN505m:rNJNJNJNJNJNJNJNJNB
  • MD5 SHA1 SHA512 SSDEEP

  Score

  1^/10
  behavioral7behavioral8