Extracted

• • Target
    SteamTokenLogin/XWormSteamTokenLogin.exe
  • Size 11.7MB
  • SHA256 c53e944d97dc63801bc2d7d520975fcb4ceb71911fdf04bf1c86e1489814febf
  • MD5 d4007a83505ba64e22a620f08ef8cb8a
  • SHA1 554b2677c0c5e66d5dfffec18f0916d6ee62ae99
  • SHA512 c01538eaf3901d2a9e8a90638341701c857dc48b3b6cd946f75e20f75c02cf01585656b48d9f7a3a81ba9131faaccc6c984f87ccd984cbcbc7ac9dfbcaa33f6e
  • SSDEEP 196608:pqYMFkI1AUCv3YNIGmk0xuc1NwO8urHQZD9BKG+5fc2S/ErXKEtw+B/onXmMsqgr:poKcCvHbxx9rr8u0ZDvV+53SM8+BoXZ
  • TLSH
    T15EC63314BBD109EAF9E3E23A87508CB9D3707C032792CEDB839486212D776E51E36756
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  7^/10

  • Loads dropped DLL

  behavioral1
• • Target
    XWorm V7.4.exe
  • Size 22.1MB
  • SHA256 98f0a3fe8cedb340ace6bd1dcb57360d75e52b63074fb39cad09811da8ff4378
  • MD5 69798950c9f217f0f1ac75264a7fea40
  • SHA1 864b00372a97975c8c56bfe56d8837b52bc038a2
  • SHA512 dcf3117d985086868e88ec9f972fd80edc9185c5334498bc32a88b09d389029190cde6053b0cbbfd8c509f1804c01ff5badc64bc84f75bf7aa5e84569cf64a15
  • SSDEEP 393216:bdoTzMjoCm1w7UzfRVM1EOJOy0VM4Mas+M0HKefOd1p:bdyCmG7UM1ky0VM4MvbM+1p
  • TLSH
    T15D379F64B4B4587C91627A3B05B2170A6B38BD1AD65E75F50E8FD00E20F23F4ED2D9B8
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defense_evasiondiscoveryexploitdonutloaderxwormloaderrattrojan

  • Detect Xworm Payload

  • Detects DonutLoader

    loader

  • Family: DonutLoader

    DonutLoader is a position-independent code that enables in-memory execution of VBScript, JScript, EXE, DLL files and dotNET assemblies.

    loaderdonutloader

  • Family: Xworm

    Xworm is a remote access trojan written in C#.

    trojanratxworm

  • Possible privilege escalation attempt

    exploit

  • Executes dropped EXE

  • Indicator Removal: Clear Windows Event Logs

    Clear Windows Event Logs to hide the activity of an intrusion.

    defense_evasion

  • Modifies file permissions

    discovery

  • Uses the VBS compiler for execution

  behavioral2