Extracted

• • Target
    x4e9af15bea08756735e5ecbf619475f5ab81ba8202df98a2be73a731804d0d50.exe
  • Size 663KB
  • SHA256 4e9af15bea08756735e5ecbf619475f5ab81ba8202df98a2be73a731804d0d50
  • MD5 84510b46b643eee288e585422cdb799c
  • SHA1 5e300e35914a4d9cebaa78d19f5c7533be98f5ca
  • SHA512 bbc1f165b15aa527e042c9cd19f4c43818afe4fc4fd857431c5698adaf9b83904b8f7c67afe8176301eb2a715995c4e6618b4609847eb0aa309f38af2d9baf74
  • SSDEEP 12288:jYyDi5rNiQ7uysMFZzN/E/msumG7/GaUWii9LBfsHPAhrPrDMu:EyvgUGkQLRsverPEu
  • TLSH
    T143E48C17F74508F9E49AC1788B928222EA7178860B31FADF178843262F67BE45F3D754
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  xwormpersistenceratspywarestealertrojan

  • Detect Xworm Payload

  • Family: Xworm

    Xworm is a remote access trojan written in C#.

    trojanratxworm

  • Drops startup file

  • Executes dropped EXE

  • Modifies system executable filetype association

    persistence

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Adds Run key to start application

    persistence

  • Contacts third-party web service commonly abused for C2

    Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.

  • Enumerates connected drives

    Attempts to read the root path of hard drives other than the default C: drive.

  behavioral1behavioral2