Extracted

• • Target
    xa0935f4655433b0793c32a870a3f45e9b6c27143beeadac07298e9d0223709e7.exe
  • Size 399KB
  • SHA256 a0935f4655433b0793c32a870a3f45e9b6c27143beeadac07298e9d0223709e7
  • MD5 88c8221c99789f1923b6787ce58f609d
  • SHA1 8ca74226fbb6f8e8284da6c77d7c503f0dc91eaf
  • SHA512 6216b2ee7887750cce114f717075d830fe2e7c41d0ee866d9e0b24ccbb6e5952e38f4c983c066a961cc117c99d9e237e8bf3167d4929266c3a4a9fa4ad515812
  • SSDEEP 6144:j+GYnA0zeWsDi5rJzip8kd3f+RysMFZzN/E/msHOtbMrbqNsarw5MF3:jYyDi5rNipDuysMFZzN/E/msumX7sIY3
  • TLSH
    T19E948D16F79408FDD4ABC57489A24546DA39B88B1B31EEDF17C8432A1F23BE08E39754
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  xwormpersistenceratspywarestealertrojan

  • Detect Xworm Payload

  • Family: Xworm

    Xworm is a remote access trojan written in C#.

    trojanratxworm

  • Drops startup file

  • Executes dropped EXE

  • Modifies system executable filetype association

    persistence

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Adds Run key to start application

    persistence

  • Contacts third-party web service commonly abused for C2

    Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.

  • Enumerates connected drives

    Attempts to read the root path of hard drives other than the default C: drive.

  behavioral1behavioral2