Extracted

Extracted

• • Target
    new policy.scr.exe
  • Size 2.3MB
  • SHA256 3a5134cc11c7c47b7268e7bf6bf1556c5ff5044af54b7931cae652bfd8d83717
  • MD5 01e7e40055d24780359493decf90ac21
  • SHA1 b59b66a3af3a9920b7de22975997a1ec1e4d5528
  • SHA512 d6069f19cb7acafe771abd095ac9de17767f31dad21951488dd91b56eec65674033e7aad25d038a4f1cd067e1e7fe91f1e8d9bfcf75c593209befe876ac9ffc1
  • SSDEEP 24576:RGvPRpFuolzFPJ+l3Drhea534ESvFpLa35sfp+ee:
  • MD5 SHA1 SHA512 SSDEEP

  Score

  10^/10

  xwormdiscoverypersistencerattrojannanocoreevasionkeyloggerspywarestealer

  • Detect Xworm Payload

  • NanoCore

    NanoCore is a remote access tool (RAT) with a variety of capabilities.

    keyloggertrojanstealerspywarenanocore

  • Suspicious use of NtCreateUserProcessOtherParentProcess

  • Xworm

    Xworm is a remote access trojan written in C#.

    trojanratxworm

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Adds Run key to start application

    persistence

  • Checks whether UAC is enabled

    evasiontrojan

  • Suspicious use of SetThreadContext

  behavioral1behavioral2