Extracted

• • Target

    XWormV5.6.exe

  • Size

    14.4MB

  • MD5

    f797a463b2ad1a0527503bf4d46f7fec

  • SHA1

    184bf019868b7c23ab6d21c13a7173ee950aec9b

  • SHA256

    74e60554bfe9ff20a5a31bd25d5d734619b17deb69d0d3166053d6a48957ed61

  • SHA512

    be16df0300e286705f523141a6e2103fecd842d7068e5df47b303dbaac655214c7a28b12d38539238b47185c4812643efd65cb30b8b7cd4491433b930c67369d

  • SSDEEP

    196608:CH/BAe1d4ihvy85JhhYc3BSL1kehn4inje1:CnyIhhkRka4iY

  Score

  10^/10

  umbralxwormdiscoveryexecutionratstealertrojan

  • Detect Umbral payload

  • Detect Xworm Payload

  • Umbral

    Umbral stealer is an opensource moduler stealer written in C#.

    stealerumbral

  • Umbral family

    umbral

  • Xworm

    Xworm is a remote access trojan written in C#.

    trojanratxworm

  • Xworm family

    xworm

  • Command and Scripting Interpreter: PowerShell

    Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

    execution

  • Drops startup file

  • Executes dropped EXE

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  behavioral1