Extracted

• • Target
    example_protected.exe
  • Size 1.8MB
  • SHA256 4fb151010a77003ee52af0b25a3c609717c143294497752a8c59093e53bd68e8
  • MD5 d382a3e83b03ccb343251eab7e8974d5
  • SHA1 649d639fc918d2f44360d27358ab7c5c8adf0496
  • SHA512 2a40dca32e1744346aa81b31ad1b9de4d37b3d9230138b6de18411c3f1eef0618793f1ffc6aa8e93b2a47db2b01e7149cd2dc2449a300989fb45df0101e3663b
  • SSDEEP 49152:r6Do+T4Avru3Kqw6ewZ6K7cy73C3La2UYSil:rgNdC67ySLa/YSi
  • TLSH
    T17D85339E24693AD4CE38FBFE386B48466C42D451372692F5882F4D8C6507BCF1BE4B91
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defense_evasiondiscoveryexecutionxwormpersistenceratthemidatrojan

  • Detect Xworm Payload

  • Xworm

    Xworm is a remote access trojan written in C#.

    trojanratxworm

  • Xworm family

    xworm

  • Identifies VirtualBox via ACPI registry values (likely anti-VM)

    defense_evasion

  • Command and Scripting Interpreter: PowerShell

    Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

    execution

  • Manipulates Digital Signatures

    Attackers can apply techniques such as changing the registry keys of authenticode & Cryptography to make their binary seem validly signed.

  • Checks BIOS information in registry

    BIOS information is often read in order to detect sandboxing environments.

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Drops startup file

  • Executes dropped EXE

  • Themida packer

    Detects Themida, an advanced Windows software protection system.

    themida

  • Adds Run key to start application

    persistence

  • Checks whether UAC is enabled

    defense_evasiontrojan

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Suspicious use of NtSetInformationThreadHideFromDebugger

  behavioral1behavioral2