Extracted

Extracted

• • Target
    XBinderOutput2.exe
  • Size 12.1MB
  • SHA256 1857ca432a680b69e247e61cb4c95b8b7827ea3d32cbe716251ab9f2b6b6d766
  • MD5 43949f2de3c160b7135a11d4d292b8b3
  • SHA1 d1346c0bca958e3c225a7653f09cee36d840285a
  • SHA512 9c7e7c594f8936935de152a7c334b9f19a4fae0d521a23d2e523171bc5b9522c30897109c4e1dd8dfb61cb722031ed0ce60da7a1c088d6e5856b06fee8ce43bc
  • SSDEEP 196608:GW4NDHH+SJcOpbN5oKesKFewST06Ov5qMoHp9ZHBgdMMwHdzS5sUUTLxD:nsDnFpbHieTo5tolhgdMMwHM5srR
  • TLSH
    T137D633F46AC93974F2EB4B3D73624FE9C9A62725342E02B8E0E4435D8BD7A8D45DC850
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  discoveryexecutionxbinderxwormloaderpersistencerattrojandefense_evasion

  • Detect Xworm Payload

  • Family: XBinder

    XBinder is a crypter and loader delivering a wide variety of malware, written in C#.

    loaderxbinder

  • Family: Xworm

    Xworm is a remote access trojan written in C#.

    trojanratxworm

  • Command and Scripting Interpreter: PowerShell

    Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

    execution

  • Downloads MZ/PE file

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Drops startup file

  • Executes dropped EXE

  • Loads dropped DLL

  • Adds Run key to start application

    persistence

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery

  • Enumerates connected drives

    Attempts to read the root path of hard drives other than the default C: drive.

  behavioral1behavioral2