Extracted

Extracted

• • Target
    PlainX.Crypter.zip
  • Size 13.0MB
  • SHA256 0bc0e4ad660c382f3291d9cff6e43e4e4f2a6875678b8557bf237f2ef5360eb8
  • MD5 e10e5d43fd0d1ffaff35f5992916204f
  • SHA1 8b0f6bbfdba45cf09a56b553a1684c5717f1cf2a
  • SHA512 4f85ee02468327eab59202f4db325437e9636f7104f751619f642cf7f3eadb34952132d64d55dfee6d7635d94b21b8dba0e35ba62af5856f69aa238bc080c1bb
  • SSDEEP 393216:SrNev055XcxGsyF37u/md7uB1tzfSyhMO:SrVjXUG3kmd7uB1tzfSyiO
  • MD5 SHA1 SHA512 SSDEEP

  Score

  10^/10

  stealeriumxwormdiscoveryexecutionpersistenceratstealertrojan

  • Detect Xworm Payload

  • Stealerium

    An open source info stealer written in C# first seen in May 2022.

    stealerstealerium

  • Stealerium family

    stealerium

  • Xworm

    Xworm is a remote access trojan written in C#.

    trojanratxworm

  • Xworm family

    xworm

  • Command and Scripting Interpreter: PowerShell

    Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

    execution

  • Drops startup file

  • Executes dropped EXE

  • Adds Run key to start application

    persistence

  • Legitimate hosting services abused for malware hosting/C2

  behavioral1