Extracted

• • Target

    Quote RFQ.exe

  • Size

    1010KB

  • MD5

    14d3aeef6abc3681e6bd62e11b234474

  • SHA1

    c6eca792ee935e2bc72d609885a3af5a4152f718

  • SHA256

    de6fac6b59c67176d1d70cf6880322f218db673702310ee635a44d84661e201d

  • SHA512

    d3bc1965ef46702fdf4bacf44f97d66467dddbc671095efc983b017446d6b5782c8a4b4032ec36803e2119fe1f10006e8779fb80a8858ba1cb6f9686f77ab6f5

  • SSDEEP

    6144:wl4H4444C8trzGtVlEzYLfHcmcFfp2oWBw0yga1gTI9pRLG7NzhhnW05LHWD9Vxm:A4H4444CyIlEcfvAft0ygtTURCHlny9q

  Score

  10^/10

  xwormdiscoveryevasionexecutionrattrojan

  • Detect Xworm Payload

  • UAC bypass

    evasiontrojan

  • Windows security bypass

    evasiontrojan

  • Xworm

    Xworm is a remote access trojan written in C#.

    trojanratxworm

  • Looks for VirtualBox Guest Additions in registry

    evasion

  • Command and Scripting Interpreter: PowerShell

    Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

    execution

  • Looks for VMWare Tools registry key

    evasion

  • Checks BIOS information in registry

    BIOS information is often read in order to detect sandboxing environments.

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Drops startup file

  • Loads dropped DLL

  • Windows security modification

    evasiontrojan

  • Checks whether UAC is enabled

    evasiontrojan

  • Maps connected drives based on registry

    Disk information is often read in order to detect sandboxing environments.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2