Extracted

• • Target

    ShellExperience.exe

  • Size

    94KB

  • MD5

    2bf7a8f812b079dc8319a76d67eb88fa

  • SHA1

    84eb63daa0bb7c1052da5d8c2dd2b82cf2be2b64

  • SHA256

    3150d0efff068e6f2963891667085ff0b7e841b2208e0bddb368c05246bb8829

  • SHA512

    6aed3c34d4f6991755432aa3c5b8f11ccaba5796118ffe64d2d912d1132ab1cd6250be76536a1640332cb0f8d5d56406683443722dd2f499973025929bf308ba

  • SSDEEP

    1536:q2bxcRngtUyosQVElr6kqmEyCB9bcqtyn/IjWuUHNNPROBDB4u/v7IVn1ksZu3J:F1UngGyoRV22kqm89bfty/znNJROxB4u

  Score

  10^/10

  xwormratspywarestealertrojan

  • Detect Xworm Payload

  • Xworm

    Xworm is a remote access trojan written in C#.

    trojanratxworm

  • Xworm family

    xworm

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  behavioral1