Extracted

• • Target
    x659e750108dcea643e01a9d881c55793b333c2e46f7cbc029b1d3b0b9fe5d246.exe
  • Size 458KB
  • SHA256 659e750108dcea643e01a9d881c55793b333c2e46f7cbc029b1d3b0b9fe5d246
  • MD5 a84bc6842bf985c59151eaa9524ca759
  • SHA1 4ccc89ec50a1aef3407b67bb98a6a409d2e70da0
  • SHA512 d0977d41a5c88f7528a921e5bc51c77ac46a18edde3845fd83a220246aadc7a94d6aa24251dd9422e3dc5b818c836ce4bbb9e70a4303058f34edea14cef1b336
  • SSDEEP 6144:j+GYnA0zeWsDi5rJziQ8kV3f+RysMFZzN/E/msHOtbMriCNeqrw4wKbgZpwKbgZC:jYyDi5rNiQ7uysMFZzN/E/msumGlczEF
  • TLSH
    T1C2A49D06F75408FCE5ABC17489A24556EA35BC8A0B72EADF17C8432A1F337E08E39755
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  xwormpersistenceratspywarestealertrojan

  • Detect Xworm Payload

  • Family: Xworm

    Xworm is a remote access trojan written in C#.

    trojanratxworm

  • Drops startup file

  • Executes dropped EXE

  • Modifies system executable filetype association

    persistence

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Adds Run key to start application

    persistence

  • Contacts third-party web service commonly abused for C2

    Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.

  • Enumerates connected drives

    Attempts to read the root path of hard drives other than the default C: drive.

  behavioral1behavioral2