Extracted

Extracted

• • Target
    k3t05Da.exe
  • Size 5.9MB
  • SHA256 fb0fe7e716caf3e0dcb1fbb6824466f807aa85295bfc7ed7046febf3331dab88
  • MD5 5cfc96efa07e34454e5a80a3c0202c98
  • SHA1 65804d32dc3694e8ec185051809a8342cf5d5d99
  • SHA512 1965ddab497907e3bf24f656f1085117c3f57c830e11c54068914df9d41de477eb6d23154ee0b7bd7781081aa7046390c9eccc2c80dbdfd3eb2693eef4ea1e01
  • SSDEEP 98304:vWRINcH5pNN/N91h2eDZQjL7sU8I5DKBWoClkRGJewd8Y3evBQ9LtYVrEx3/o6EU:ORINg9GeDVI5DKBWZlkgJedYs6LtYdEV
  • MD5 SHA1 SHA512 SSDEEP

  Score

  10^/10

  xwormagilenetdefense_evasiondiscoveryexecutionratthemidatrojan

  • Detect Xworm Payload

  • Xworm

    Xworm is a remote access trojan written in C#.

    trojanratxworm

  • Xworm family

    xworm

  • Identifies VirtualBox via ACPI registry values (likely anti-VM)

    defense_evasion

  • Blocklisted process makes network request

  • Command and Scripting Interpreter: PowerShell

    Run Powershell and hide display window.

    execution

  • Command and Scripting Interpreter: PowerShell

    Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

    execution

  • Checks BIOS information in registry

    BIOS information is often read in order to detect sandboxing environments.

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Drops startup file

  • Loads dropped DLL

  • Obfuscated with Agile.Net obfuscator

    Detects use of the Agile.Net commercial obfuscator, which is capable of entity renaming and control flow obfuscation.

    agilenet

  • Themida packer

    Detects Themida, an advanced Windows software protection system.

    themida

  • Checks whether UAC is enabled

    defense_evasiontrojan

  • Suspicious use of SetThreadContext

  behavioral1behavioral2