Extracted

Extracted

• • Target
    8ae85132b8b81d6278e254109515f631c388104e2297a8aa63ba77d00ce85432.exe
  • Size 556KB
  • SHA256 8ae85132b8b81d6278e254109515f631c388104e2297a8aa63ba77d00ce85432
  • MD5 13be8829804a0011f9ba22c0d28542ed
  • SHA1 b7e9dad21dc6a860722df438d4bf2b0d6e377465
  • SHA512 0c2a06023899075af08d4d7fcef8e936550d00c51e31587dfb047776af1ba3ceac72493bf1559bd5ffba5f0e7753cbc6f106a7ddd5b29109e01a957d0ef1f8a5
  • SSDEEP 12288:qVwotBJLEJE4MAShlOSyMzY5A/DLcN/VjyGJPztq0rlekR:lotVPTOSi5x/v1rlF
  • MD5 SHA1 SHA512 SSDEEP

  Score

  10^/10

  discoveryexecutionlatentbotxwormpersistenceratspywarestealertrojan

  • Contains code to disable Windows Defender

    A .NET executable tasked with disabling Windows Defender capabilities such as realtime monitoring, blocking at first seen, etc.

  • Detect Xworm Payload

  • LatentBot

    Modular trojan written in Delphi which has been in-the-wild since 2013.

    trojanlatentbot

  • Latentbot family

    latentbot

  • Xworm

    Xworm is a remote access trojan written in C#.

    trojanratxworm

  • Xworm family

    xworm

  • Command and Scripting Interpreter: PowerShell

    Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

    execution

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Drops startup file

  • Executes dropped EXE

  • Loads dropped DLL

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Adds Run key to start application

    persistence

  • Suspicious use of SetThreadContext

  behavioral1behavioral2