Extracted

• • Target
    x2c5fe8508d36c8c79ceeb3f20f8f25ea84514a8bb02eac6518afb2b6fd559561.exe
  • Size 399KB
  • SHA256 2c5fe8508d36c8c79ceeb3f20f8f25ea84514a8bb02eac6518afb2b6fd559561
  • MD5 8644804d89c14fe1d281c9022f340eb6
  • SHA1 0382a249522814c03c3f3912f1852a5425694584
  • SHA512 e6da1bd477ba07d3c0a7b07b21682c768ed70ff5edb7dbb7cc3383186b6b6deef7c6440830ff2e68b2746718262258344006a3ec5cd38656851f8301ead116c5
  • SSDEEP 6144:j+GYnA0zeWsDi50JziQ8kd3f+RysMFZzN/E/msHOtbMriqNsarwDV:jYyDi50NiQDuysMFZzN/E/msumG7s+V
  • TLSH
    T13F948D06FB9408F9D5ABC57489A24546DA39BC8B1B31EEDF17C8432A1F237E08E39754
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  xwormpersistenceratspywarestealertrojan

  • Detect Xworm Payload

  • Family: Xworm

    Xworm is a remote access trojan written in C#.

    trojanratxworm

  • Drops startup file

  • Executes dropped EXE

  • Modifies system executable filetype association

    persistence

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Adds Run key to start application

    persistence

  • Contacts third-party web service commonly abused for C2

    Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.

  • Enumerates connected drives

    Attempts to read the root path of hard drives other than the default C: drive.

  behavioral1behavioral2