Extracted

• • Target

    DeadStealer.exe

  • Size

    4.3MB

  • MD5

    c4a908dcbd6e7e233dd9b8262c94ac39

  • SHA1

    bb2a46603908e118dbbb1c74fd377f4e5427e3fe

  • SHA256

    a4beca9447f15277f11843a2109ce49e0f4c69055e2c17ed60d59e24cefea82a

  • SHA512

    d71213e64a4f0a2071e8d5c782debb35ddd4788c7eb0c155497f40c7b5710417ce1d7a553758edeee95bf0ca68825386da2557bda4ead95191d4b7c8515bb1aa

  • SSDEEP

    98304:RkjozJ9/im8XVBKl6tmJVP2sRx/E0T7zN3HtHOIT4bNJFY3Oqt2SGuA+i1i:tzJpjS346tmJ1ds+7ptHOjBHYm9uAm

  Score

  10^/10

  xwormagilenetdiscoveryexecutionpersistencerattrojan

  • Detect Xworm Payload

  • Suspicious use of NtCreateUserProcessOtherParentProcess

  • Xworm

    Xworm is a remote access trojan written in C#.

    trojanratxworm

  • Command and Scripting Interpreter: PowerShell

    Using powershell.exe command.

    execution

  • Downloads MZ/PE file

  • Drops startup file

  • Executes dropped EXE

  • Obfuscated with Agile.Net obfuscator

    Detects use of the Agile.Net commercial obfuscator, which is capable of entity renaming and control flow obfuscation.

    agilenet

  • Adds Run key to start application

    persistence

  • Legitimate hosting services abused for malware hosting/C2

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Drops file in System32 directory

  • Suspicious use of SetThreadContext

  behavioral1