Extracted

• • Target

    XClient.exe

  • Size

    174KB

  • MD5

    a6cc70ece3acb1443a203972dc007a6c

  • SHA1

    c2bfd3e0a43bffcb7dbba118e507c423c5ed8869

  • SHA256

    abe47f0361c9878b2f4475dc8989e9055012a0c4ce1cc18f913bc9b89d618b45

  • SHA512

    a1c9aad284b2a14b12f22154d8bc6500d0ff4d330671fc958c0a0fab3a7437bccbaec5e8ca099f399f2ab4499dccea7224f68dedf726ed1818b2fbcd2819fa1f

  • SSDEEP

    3072:jNWJcweLkbmlHBOgzca3v7EsUT8rmtIhF:jacAbCT/HUTftO

  Score

  10^/10

  ramnitxwormbankercredential_accessdefense_evasiondiscoveryevasionexecutionpersistenceratspywarestealertrojanupxworm

  • Contains code to disable Windows Defender

    A .NET executable tasked with disabling Windows Defender capabilities such as realtime monitoring, blocking at first seen, etc.

  • Detect Xworm Payload

  • Modifies Windows Defender DisableAntiSpyware settings

    evasiontrojan

  • Modifies Windows Defender Real-time Protection settings

    defense_evasiontrojan

  • Ramnit

    Ramnit is a versatile family that holds viruses, worms, and Trojans.

    trojanspywarestealerwormbankerramnit

  • Ramnit family

    ramnit

  • Suspicious use of NtCreateUserProcessOtherParentProcess

  • Xworm

    Xworm is a remote access trojan written in C#.

    trojanratxworm

  • Xworm family

    xworm

  • Credentials from Password Stores: Windows Credential Manager

    Suspicious access to Credentials History.

    credential_accessstealer

  • Executes dropped EXE

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Adds Run key to start application

    persistence

  • Command and Scripting Interpreter: PowerShell

    Using powershell.exe command.

    execution

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  behavioral1