Extracted

Extracted

• • Target

    PlainX.Crypter.zip

  • Size

    13.0MB

  • MD5

    e10e5d43fd0d1ffaff35f5992916204f

  • SHA1

    8b0f6bbfdba45cf09a56b553a1684c5717f1cf2a

  • SHA256

    0bc0e4ad660c382f3291d9cff6e43e4e4f2a6875678b8557bf237f2ef5360eb8

  • SHA512

    4f85ee02468327eab59202f4db325437e9636f7104f751619f642cf7f3eadb34952132d64d55dfee6d7635d94b21b8dba0e35ba62af5856f69aa238bc080c1bb

  • SSDEEP

    393216:SrNev055XcxGsyF37u/md7uB1tzfSyhMO:SrVjXUG3kmd7uB1tzfSyiO

  Score

  10^/10

  stealeriumxwormdiscoveryexecutionpersistenceratstealertrojan

  • Detect Xworm Payload

  • Stealerium

    An open source info stealer written in C# first seen in May 2022.

    stealerstealerium

  • Stealerium family

    stealerium

  • Xworm

    Xworm is a remote access trojan written in C#.

    trojanratxworm

  • Xworm family

    xworm

  • Command and Scripting Interpreter: PowerShell

    Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

    execution

  • Drops startup file

  • Executes dropped EXE

  • Adds Run key to start application

    persistence

  • Legitimate hosting services abused for malware hosting/C2

  behavioral1