Extracted

Extracted

Extracted

• • Target
    TWS INTL QUOTATION_#J150034 #LTCS A420  TW8312026.pdf(105KB).com
  • Size 761KB
  • SHA256 f6f360b03675336a93e254c039138ce99951c33f29998bbcd30c699b80877a8f
  • MD5 0957d882e1564bf81e369c069d140eb1
  • SHA1 13fef5d5cad1ef9d2a1f354255d262816897498c
  • SHA512 7b693074d44d9e3f1c7ea2b82dfa31353ed0076eb244a6ff32c04c2e983c29bbfd257623bc28dcc6066d561af611113177f0b9d7ad3d524a591e4261ce1ac138
  • SSDEEP 12288:W5HvBciNB6RlGgrpJykOxZ6N7g+mJ/kYgTils9LW3FEBQ0odb1yo2XkR:q5ciaCgCxoS+mdkYgmuLW8QVEoX
  • TLSH
    T1C9F4F1492759EE43C4A25FF05971E37817F89E996811C3038FFAEDFBB56970628042A3
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  b-wbkup xx26bw-wlddefense_evasiondiscoveryexecutionquasarremcosxpertratxwormpersistenceratspywaretrojan

  • Detect Xworm Payload

  • Quasar RAT

    Quasar is an open source Remote Access Tool.

    trojanspywarequasar

  • Quasar family

    quasar

  • Quasar payload

  • Remcos

    Remcos is a closed-source remote control and surveillance software.

    ratremcos

  • Remcos family

    remcos

  • UAC bypass

    defense_evasiontrojan

  • Windows security bypass

    defense_evasiontrojan

  • XpertRAT

    XpertRAT is a remote access trojan with various capabilities.

    ratxpertrat

  • XpertRAT Core payload

  • Xpertrat family

    xpertrat

  • Xworm

    Xworm is a remote access trojan written in C#.

    trojanratxworm

  • Xworm family

    xworm

  • Adds policy Run key to start application

    persistence

  • Badlisted process makes network request

    Network request originating from process or tool commonly abused by malware.

  • Command and Scripting Interpreter: PowerShell

    Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

    execution

  • Downloads MZ/PE file

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Drops startup file

  • Executes dropped EXE

  • Windows security modification

    defense_evasiontrojan

  • Adds Run key to start application

    persistence

  • Checks whether UAC is enabled

    defense_evasiontrojan

  • Obfuscated Files or Information: Command Obfuscation

    Adversaries may obfuscate content during command execution to impede detection.

    defense_evasion

  • Program crash

  • Suspicious use of SetThreadContext

  behavioral1behavioral2