Extracted

• • Target

    BlitzedGrabberV12.exe

  • Size

    4.7MB

  • MD5

    f1417759e105ff9909ed454ad5db48a0

  • SHA1

    d8ff4cfa49616988882f1d4e6318db869acd75ce

  • SHA256

    966cee8682727f4f09d137b4924ec6daeb7c0b9dcb8b9700be8c3e73c57c6b60

  • SHA512

    e0359c601e59b56c1d5e324c85692b3f3db94adb1a2110c5fd3e6ab248475d27fa1f2aff86f57c0d99ae328cf4e68783a84af41049d7856c3b940ab6ef19b675

  • SSDEEP

    98304:hmVrrT79MEH/TSbOJfUhEpZlm5qqCabiiSXiBuxIr7n:h2rlMEfTa6fUWlQzCaWiIsX

  Score

  10^/10

  xwormdefense_evasiondiscoverypersistenceratthemidatrojan

  • Detect Xworm Payload

  • Xworm

    Xworm is a remote access trojan written in C#.

    trojanratxworm

  • Xworm family

    xworm

  • Identifies VirtualBox via ACPI registry values (likely anti-VM)

    defense_evasion

  • Checks BIOS information in registry

    BIOS information is often read in order to detect sandboxing environments.

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Themida packer

    Detects Themida, an advanced Windows software protection system.

    themida

  • Adds Run key to start application

    persistence

  • Checks whether UAC is enabled

    defense_evasiontrojan

  • Suspicious use of NtSetInformationThreadHideFromDebugger

  behavioral1behavioral2