Extracted

• • Target

    x360ce/data/Reg.data

  • Size

    14.7MB

  • MD5

    be80f3348b240bcee1aa96d33fe0e768

  • SHA1

    40ea5de9a7a15f6e0d891cd1ba4bca8519bb85ed

  • SHA256

    74faf334cb0bdd3e9dfab8c323d4eb3b9b089bcaadc7dbd639d9aa93a4f6f829

  • SHA512

    dfb3b191152981f21180e93597c7b1891da6f10b811db2c8db9f45bbecc9feb54bc032bdd648c7ad1134e9b09e5e2b9705d5e21294e1ae328a4390350745536a

  • SSDEEP

    196608:n+/7/fO/vBSVnf+viDyJBwhsCArf+viDyJBQhsCAaIF/f+viDyJBaF9hsCA6EJ0k:nX/vu0Bwhs8vu0BQhsvFOvu0BaF9hsR

  Score

  4^/10

  discovery
  behavioral1behavioral2

• • Target

    x360ce/data/Reg.dll

  • Size

    270KB

  • MD5

    babe69e99dded0a2f1362e596b31c718

  • SHA1

    5f2cf112eb24a14e701c4adb2a50aab81afda083

  • SHA256

    94ac046fbe73a603bffed9c3360c66eb87c58025d99e5090ed330e00dbf1d07b

  • SHA512

    9a3c61b498b05c4a2039aeefb2969436acd3d0245e56fbf728f2eb80f1f9dfcb4012c483678747e8afe99b794e394dfd02347bf8d2f197516c487a53aa204765

  • SSDEEP

    6144:wTXqI/36A2JEq6AiAlP17338hHxR38GK5d0eKZTuJYYX+360f0eD:wTriA2JuAi6PRmHxF8GmtKhuJP+3CeD

  Score

  1^/10
  behavioral3behavioral4

• • Target

    x360ce/x360ce.exe

  • Size

    162KB

  • MD5

    d50289d1ba4b88774309b4ca8ee10ea4

  • SHA1

    b88976f789650c10922c665386ab929c5bf45728

  • SHA256

    ed6c4a4dabead55eff566e48c9d67865a18fdf90871119b9011f9db523a67d8f

  • SHA512

    9d682961c698328e545a6fca2b50d6acd33389aca4d8e4b8ee2f24bea7598117b763c8b287e62804e0e4660042d9573150c969dbd651414e62ad32568e877c2f

  • SSDEEP

    3072:3brZEFa/cwLLd85Ml1hL8nIwbAC1LwcEQkQkLY9nvu1Tno6vG2hwCxXdbqYun6L:3bx/caLd854qn9ECFwcEQWCUTnooG27B

  Score

  10^/10

  xwormdefense_evasionexecutionrattrojan

  • Detect Xworm Payload

  • Xworm

    Xworm is a remote access trojan written in C#.

    trojanratxworm

  • Blocklisted process makes network request

  • Command and Scripting Interpreter: PowerShell

    Run Powershell and hide display window.

    execution

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Indicator Removal: Clear Windows Event Logs

    Clear Windows Event Logs to hide the activity of an intrusion.

    defense_evasion

  • Loads dropped DLL

  • Enumerates connected drives

    Attempts to read the root path of hard drives other than the default C: drive.

  • Drops file in System32 directory

  behavioral5behavioral6