Extracted

• • Target

    Client_protected.exe

  • Size

    2.9MB

  • MD5

    29e814ca993bb291e2965e965efea4e7

  • SHA1

    04e4771d22bcc4fcfaeecec4e45177e4f16752e7

  • SHA256

    24e4267cb003cbeb5bdaffbf4089bff010cad46033172894165e765adb55f308

  • SHA512

    340cb2d1381175bf0c6d33901b3bfd6b5ef13affb236901922f942f0b085e99b3bdce358a2066cdf636af2634858a18a3cc0c25862a6258f3c695668524bcc68

  • SSDEEP

    49152:DWcmOyXHtKsdNH4R8Qips6kIbBAQMaNJObmgd3nQCxdfNd26k:DeRos94tipTOQJObm63bdT

  Score

  10^/10

  xwormdiscoveryevasionexecutionpersistenceratthemidatrojan

  • Detect Xworm Payload

  • Xworm

    Xworm is a remote access trojan written in C#.

    trojanratxworm

  • Xworm family

    xworm

  • Identifies VirtualBox via ACPI registry values (likely anti-VM)

    evasion

  • Command and Scripting Interpreter: PowerShell

    Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

    execution

  • Checks BIOS information in registry

    BIOS information is often read in order to detect sandboxing environments.

  • Drops startup file

  • Executes dropped EXE

  • Themida packer

    Detects Themida, an advanced Windows software protection system.

    themida

  • Adds Run key to start application

    persistence

  • Checks whether UAC is enabled

    evasiontrojan

  • Legitimate hosting services abused for malware hosting/C2

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Suspicious use of NtSetInformationThreadHideFromDebugger

  behavioral1