Extracted

• • Target
    898dd28e3c6ea2bbf2a3274bdc8a5d76e60f8c68eb1a1.exe
  • Size 854KB
  • SHA256 898dd28e3c6ea2bbf2a3274bdc8a5d76e60f8c68eb1a16749090c8273fe3264f
  • MD5 5c5fc5b15b494e40d2ac75a5678f6399
  • SHA1 6c89627da81ec732cf1bf1c7f3e5d18f6f09cbe1
  • SHA512 b87dc790cb42b5640e603176fcafe4bbf3aa7d0eb137c84624782b36ebf40fc9de41fe5485c44820c2fd18866a53601fb559f955020bcc6cb9065e0f6737a9a3
  • SSDEEP 24576:qKqpCZGE96zN4tqEKmJM60PkE16YeGVBhEv748BdEU9RcxPSi7OWBBJfwCVVQNIB:T0os
  • MD5 SHA1 SHA512 SSDEEP

  Score

  10^/10

  xwormpersistenceratspywarestealertrojan

  • Detect Xworm Payload

  • Xworm

    Xworm is a remote access trojan written in C#.

    trojanratxworm

  • Xworm family

    xworm

  • Drops startup file

  • Executes dropped EXE

  • Modifies system executable filetype association

    persistence

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Adds Run key to start application

    persistence

  • Enumerates connected drives

    Attempts to read the root path of hard drives other than the default C: drive.

  • Legitimate hosting services abused for malware hosting/C2

  behavioral1behavioral2