Extracted

• • Target
    xce010b0699abc1e34063ee89181658dfa3d45478aec118ef73e6ef394c62f53f.exe
  • Size 26.1MB
  • SHA256 ce010b0699abc1e34063ee89181658dfa3d45478aec118ef73e6ef394c62f53f
  • MD5 56f0e570f07f5c3f8f0523724b8e5c02
  • SHA1 0ca8bf3b6af19c50d90ca63dbf58510393d131a7
  • SHA512 e0dc739ca5e719dcb4660f92b9dfee2a151677ae794858442ae810b9c107bb09dcc1657b7c68339ed3896d633e518179a6b7e98a8fa13f7031a2b300f73786ce
  • SSDEEP 196608:Q1rbMRGJhpFUM6jZ5BlBD9cp3Se922Asz0TeUWGhiO10aI6HMaJTtGbK:Q1rcGpOjZ5BlBe3rl+kOL
  • TLSH
    T178572896B2A807D6F3A6D6345175A133E6B27C1E1711E23B0D38F10ADEB73806D19F26
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  xwormpersistenceratspywarestealertrojan

  • Detect Xworm Payload

  • Family: Xworm

    Xworm is a remote access trojan written in C#.

    trojanratxworm

  • Drops startup file

  • Executes dropped EXE

  • Modifies system executable filetype association

    persistence

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Adds Run key to start application

    persistence

  • Contacts third-party web service commonly abused for C2

    Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.

  • Enumerates connected drives

    Attempts to read the root path of hard drives other than the default C: drive.

  behavioral1behavioral2