Extracted

Extracted

• • Target

    new policy.scr.exe

  • Size

    2.3MB

  • MD5

    01e7e40055d24780359493decf90ac21

  • SHA1

    b59b66a3af3a9920b7de22975997a1ec1e4d5528

  • SHA256

    3a5134cc11c7c47b7268e7bf6bf1556c5ff5044af54b7931cae652bfd8d83717

  • SHA512

    d6069f19cb7acafe771abd095ac9de17767f31dad21951488dd91b56eec65674033e7aad25d038a4f1cd067e1e7fe91f1e8d9bfcf75c593209befe876ac9ffc1

  • SSDEEP

    24576:RGvPRpFuolzFPJ+l3Drhea534ESvFpLa35sfp+ee:

  Score

  10^/10

  xwormdiscoverypersistencerattrojannanocoreevasionkeyloggerspywarestealer

  • Detect Xworm Payload

  • NanoCore

    NanoCore is a remote access tool (RAT) with a variety of capabilities.

    keyloggertrojanstealerspywarenanocore

  • Suspicious use of NtCreateUserProcessOtherParentProcess

  • Xworm

    Xworm is a remote access trojan written in C#.

    trojanratxworm

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Adds Run key to start application

    persistence

  • Checks whether UAC is enabled

    evasiontrojan

  • Suspicious use of SetThreadContext

  behavioral1behavioral2