Extracted

• • Target
    x6db69b275c7d0eb1272ff2b5cc5b0ab10b32a4e614611a106b1f1598accc8f8e.exe
  • Size 528KB
  • SHA256 6db69b275c7d0eb1272ff2b5cc5b0ab10b32a4e614611a106b1f1598accc8f8e
  • MD5 5be2bbae81443b6e8b424fb97e842357
  • SHA1 b9909b6e80e60a7ba72c0ba3edc55d1770a4ff22
  • SHA512 9c38e3777012bf9445dc9dbdca12d024c3fb61b39a19a8e32a06d39b1d9530a90a0f83d3bc030099aeeed40a20aa667672287ec3e65c868c685b16aab955bd19
  • SSDEEP 12288:jYyDi5rNiQDuysMFZzN/E/msumG7s7CiB+Fqo:Ey3gUG2CiB/o
  • TLSH
    T1FBB47D11F7E404FDF4A7867489B646529A34BC674B31EAEF07C442291F32AE08E35B76
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  xwormpersistenceratspywarestealertrojan

  • Detect Xworm Payload

  • Family: Xworm

    Xworm is a remote access trojan written in C#.

    trojanratxworm

  • Drops startup file

  • Executes dropped EXE

  • Modifies system executable filetype association

    persistence

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Adds Run key to start application

    persistence

  • Contacts third-party web service commonly abused for C2

    Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.

  • Enumerates connected drives

    Attempts to read the root path of hard drives other than the default C: drive.

  behavioral1behavioral2