Extracted

• • Target
    xadf5eda49c0cc8eaa3f58a66b1f6f5fa564c8b8819f439a522676ea03dfe7969.exe
  • Size 1.2MB
  • SHA256 adf5eda49c0cc8eaa3f58a66b1f6f5fa564c8b8819f439a522676ea03dfe7969
  • MD5 8fc7d10450dfd5567c61761190cc2494
  • SHA1 8f791443bc697b2a3e545894953d37bdcbd7d99b
  • SHA512 3872ab22e8fbd82595d32c69daf48e3e04e35c99aab7d356e760ccd7611324afa944612b018abf0e97778ae421f5ebc54e16791c3f50b0598ae8d643e09be5ad
  • SSDEEP 12288:jYyDi5rNiQDuysMFZzN/E/msumG7sOa0wIk0BX3RKuemGd70ioGuVWW6oIWa0wIq:Ey3gUG9afDd70iTWCWafDd70iTWCv
  • TLSH
    T19D459D11B7908039F4B359368ABF9725993DB8A21F7586CFA3C8072E1E716E09E34717
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  discoveryxwormpersistenceratspywarestealertrojan

  • Detect Xworm Payload

  • Family: Xworm

    Xworm is a remote access trojan written in C#.

    trojanratxworm

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Drops startup file

  • Executes dropped EXE

  • Modifies system executable filetype association

    persistence

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Adds Run key to start application

    persistence

  • Contacts third-party web service commonly abused for C2

    Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.

  • Enumerates connected drives

    Attempts to read the root path of hard drives other than the default C: drive.

  behavioral1behavioral2