Extracted

• • Target
    x3d2cdd8b155a0eb68b6bd1f16a69e7aa36a109919185b09f07d7920844553813.exe
  • Size 943KB
  • SHA256 3d2cdd8b155a0eb68b6bd1f16a69e7aa36a109919185b09f07d7920844553813
  • MD5 6b152e0e7012ef1b86e1a60d41092bec
  • SHA1 3d00ec2a6faafef43c6c44ef116af4f675655823
  • SHA512 936b7c0d3a3326ab09d588866ce60c666b5072980e545e309a8371870cbc204ec45e3432ef519e8d624db7727eba1b0acb3058943faf36c6012cd28b4e6b35b2
  • SSDEEP 12288:jYyDi5rNiQDuysMFZzN/E/msumm7sXaplw9U+qMi8CtdVldusIh6BBHCHrKZXCk2:Ey3gUmfYTqMi8CtBd2QHCHmTBW5
  • TLSH
    T13F254B25F6648775D073C0B9C5D2968AEE3234865B30DACF128A836D2F277E5C93A731
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  xwormpersistenceratspywarestealertrojan

  • Detect Xworm Payload

  • Family: Xworm

    Xworm is a remote access trojan written in C#.

    trojanratxworm

  • Drops startup file

  • Executes dropped EXE

  • Modifies system executable filetype association

    persistence

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Adds Run key to start application

    persistence

  • Contacts third-party web service commonly abused for C2

    Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.

  • Enumerates connected drives

    Attempts to read the root path of hard drives other than the default C: drive.

  behavioral1behavioral2