Extracted

• • Target
    x360ce/data/Reg.data
  • Size 14.7MB
  • SHA256 74faf334cb0bdd3e9dfab8c323d4eb3b9b089bcaadc7dbd639d9aa93a4f6f829
  • MD5 be80f3348b240bcee1aa96d33fe0e768
  • SHA1 40ea5de9a7a15f6e0d891cd1ba4bca8519bb85ed
  • SHA512 dfb3b191152981f21180e93597c7b1891da6f10b811db2c8db9f45bbecc9feb54bc032bdd648c7ad1134e9b09e5e2b9705d5e21294e1ae328a4390350745536a
  • SSDEEP 196608:n+/7/fO/vBSVnf+viDyJBwhsCArf+viDyJBQhsCAaIF/f+viDyJBaF9hsCA6EJ0k:nX/vu0Bwhs8vu0BQhsvFOvu0BaF9hsR
  • MD5 SHA1 SHA512 SSDEEP

  Score

  4^/10

  discovery
  behavioral1behavioral2
• • Target
    x360ce/data/Reg.dll
  • Size 270KB
  • SHA256 94ac046fbe73a603bffed9c3360c66eb87c58025d99e5090ed330e00dbf1d07b
  • MD5 babe69e99dded0a2f1362e596b31c718
  • SHA1 5f2cf112eb24a14e701c4adb2a50aab81afda083
  • SHA512 9a3c61b498b05c4a2039aeefb2969436acd3d0245e56fbf728f2eb80f1f9dfcb4012c483678747e8afe99b794e394dfd02347bf8d2f197516c487a53aa204765
  • SSDEEP 6144:wTXqI/36A2JEq6AiAlP17338hHxR38GK5d0eKZTuJYYX+360f0eD:wTriA2JuAi6PRmHxF8GmtKhuJP+3CeD
  • MD5 SHA1 SHA512 SSDEEP

  Score

  1^/10
  behavioral3behavioral4
• • Target
    x360ce/x360ce.exe
  • Size 162KB
  • SHA256 ed6c4a4dabead55eff566e48c9d67865a18fdf90871119b9011f9db523a67d8f
  • MD5 d50289d1ba4b88774309b4ca8ee10ea4
  • SHA1 b88976f789650c10922c665386ab929c5bf45728
  • SHA512 9d682961c698328e545a6fca2b50d6acd33389aca4d8e4b8ee2f24bea7598117b763c8b287e62804e0e4660042d9573150c969dbd651414e62ad32568e877c2f
  • SSDEEP 3072:3brZEFa/cwLLd85Ml1hL8nIwbAC1LwcEQkQkLY9nvu1Tno6vG2hwCxXdbqYun6L:3bx/caLd854qn9ECFwcEQWCUTnooG27B
  • MD5 SHA1 SHA512 SSDEEP

  Score

  10^/10

  xwormdefense_evasionexecutionrattrojan

  • Detect Xworm Payload

  • Xworm

    Xworm is a remote access trojan written in C#.

    trojanratxworm

  • Blocklisted process makes network request

  • Command and Scripting Interpreter: PowerShell

    Run Powershell and hide display window.

    execution

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Indicator Removal: Clear Windows Event Logs

    Clear Windows Event Logs to hide the activity of an intrusion.

    defense_evasion

  • Loads dropped DLL

  • Enumerates connected drives

    Attempts to read the root path of hard drives other than the default C: drive.

  • Drops file in System32 directory

  behavioral5behavioral6