Extracted

Extracted

• • Target
    PO-LDSS26LK503.bat.exe
  • Size 477KB
  • SHA256 d28d2788b9d5b476e71fb63b71e36b3eb36fed4ca0152f36fa6f00aab857543f
  • MD5 a80e4f4d318805db0a195e43b3d8c2da
  • SHA1 40b9c76cc9434fce19022a867bd566697a789d19
  • SHA512 a979bfb3ef4114f4b7881656c5647d4a1a3b3777438c7fb5b2b2d4fa29f51b875592e72dd361a0b09755636b7543a9eee0ea8eb0d5aefcf3ee04e2ea9b73b656
  • SSDEEP 12288:Mpu0rlYENKMi5uUUsF0mAYic3EWp0ehbbD+dJS:ErlYKtouUipYtnbb
  • MD5 SHA1 SHA512 SSDEEP

  Score

  10^/10

  discoveryexecutionlatentbotxwormpersistencerattrojancollectionspywarestealer

  • Contains code to disable Windows Defender

    A .NET executable tasked with disabling Windows Defender capabilities such as realtime monitoring, blocking at first seen, etc.

  • Detect Xworm Payload

  • LatentBot

    Modular trojan written in Delphi which has been in-the-wild since 2013.

    trojanlatentbot

  • Latentbot family

    latentbot

  • Xworm

    Xworm is a remote access trojan written in C#.

    trojanratxworm

  • Xworm family

    xworm

  • Command and Scripting Interpreter: PowerShell

    Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

    execution

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Drops startup file

  • Executes dropped EXE

  • Loads dropped DLL

  • Reads user/profile data of local email clients

    Email clients store some user data on disk where infostealers will often target it.

    spywarestealer

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Accesses Microsoft Outlook profiles

    collection

  • Adds Run key to start application

    persistence

  • Suspicious use of SetThreadContext

  behavioral1behavioral2