Extracted

Extracted

• • Target

    Crypto ScarleTT.zip

  • Size

    100.5MB

  • MD5

    f72c382de5e87ccd123c1e623254ed3f

  • SHA1

    bfe62a5988a7a5b97b5e6a63e1bcae2a4c43f18d

  • SHA256

    8d06880ffcc7799c543488ecfc190f0ff920ec8aeb24e258c4cf37585be16a0b

  • SHA512

    fb7b1a45315c21d38b8e56dfea0f257df6cf527c1a59af906f595b76bcb17c7e1602479e57ebbf185de433ace56bb4521d463c6117c566e5dc4486e95965023f

  • SSDEEP

    1572864:4fqo94gbSX8+3k43neZYWqbY4lhz++RVb7tN2uQm64il0s62a8cBdOLRWjqBaw:4yof4ge0Sz+ALtQv0s6RULsed

  Score

  10^/10

  xwormdiscoveryevasionexecutionpersistencepyinstallerratspywarestealertrojan

  • Detect Xworm Payload

  • Xworm

    Xworm is a remote access trojan written in C#.

    trojanratxworm

  • Xworm family

    xworm

  • Blocklisted process makes network request

  • Sets file to hidden

    Modifies file attributes to stop it showing in Explorer etc.

    evasion

  • Drops startup file

  • Executes dropped EXE

  • Loads dropped DLL

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Adds Run key to start application

    persistence

  • Command and Scripting Interpreter: PowerShell

    Using powershell.exe command.

    execution
  behavioral1behavioral2