Extracted

• • Target

    XRCleaner2.exe

  • Size

    56KB

  • MD5

    9bc57b0a4b416e360a8e20ed5dda6cd0

  • SHA1

    7246f4cdcb19afa4de09a36972492aa067daac51

  • SHA256

    b819fd21177ac66b9c645dcc82572b3eb774a14598dac95621edb06fb5e411fc

  • SHA512

    dd306cd30727911a7c2335945721a85e8b65ece05efe3dd63e0fcb7b05033647fc881f0b78b8b6ac107ddf4f079107d51f835f5469fe4f3d6e787c620ff2fe82

  • SSDEEP

    1536:2Nltt4OCTcQLe6WskbSjJ6EoBs2vWywOvu:2NltCTcQLepskbSjToIOvu

  Score

  10^/10

  hawkeyexwormdiscoveryexecutionkeyloggerratspywarestealertrojan

  • Detect Xworm Payload

  • HawkEye

    HawkEye is a malware kit that has seen continuous development since at least 2013.

    keyloggertrojanstealerspywarehawkeye

  • Hawkeye family

    hawkeye

  • Xworm

    Xworm is a remote access trojan written in C#.

    trojanratxworm

  • Xworm family

    xworm

  • Drops startup file

  • Enumerates connected drives

    Attempts to read the root path of hard drives other than the default C: drive.

  behavioral1