Extracted

Extracted

• • Target

    XWorm.V6.0.zip

  • Size

    34.5MB

  • MD5

    a0b7d7f290385441b7b4c863d3873a22

  • SHA1

    c66d5b61e0c82c05ce271994775bf6124457b6e1

  • SHA256

    b8574159eebd064a1d7854e8422fb0222759bbc31b1469ff7866a06b4aa560f0

  • SHA512

    10ddf84eb55a0b4fbd3a6f4e2549801e897b4789baedf9b73ba00c62afe62ba8f7536f00a223a762922b46826a987a89fd3b298a6fd594978b2205c38b1b3b78

  • SSDEEP

    786432:SAei7Z9K1koiZEj6mcaFf8G46pvzgbHGgCZ1p6XEDgkP9YA/:aqSiFhuUJOgbHGahkPH/

  Score

  10^/10

  stealeriumxwormexecutionpersistenceratstealertrojan

  • Detect Xworm Payload

  • Stealerium

    An open source info stealer written in C# first seen in May 2022.

    stealerstealerium

  • Stealerium family

    stealerium

  • Xworm

    Xworm is a remote access trojan written in C#.

    trojanratxworm

  • Xworm family

    xworm

  • Command and Scripting Interpreter: PowerShell

    Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

    execution

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Drops startup file

  • Executes dropped EXE

  • Adds Run key to start application

    persistence

  • Legitimate hosting services abused for malware hosting/C2

  behavioral1behavioral2