Extracted

• • Target
    x06619553d405babcbf069fa4eccfdad79b63bbce89238973921530fc5c5e1def.exe
  • Size 11.7MB
  • SHA256 06619553d405babcbf069fa4eccfdad79b63bbce89238973921530fc5c5e1def
  • MD5 275cdd751cdc4350696932fe2c34eae5
  • SHA1 42648f8e963de87f23d5385b1bd3d72dd1f42d85
  • SHA512 32a9991f68160b320909a0fcbcb24861ff5ac128be41cb435053627bb95ae49fce3126a8df12e5c8b139fdd9b60ac42948cac3b3b50abfc017a030deebf51590
  • SSDEEP 196608:p7oes3sNq3PgggrRVRgNxHOs44gE6aI6HMaJTtGb0:p7A3s43PgFrnYS4gEF
  • TLSH
    T1CFC639C5A7A442E6E0F7C27889664033EBF1B97F5530776F0925C9A60E73A108F79B12
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  xwormpersistenceratspywarestealertrojan

  • Detect Xworm Payload

  • Family: Xworm

    Xworm is a remote access trojan written in C#.

    trojanratxworm

  • Drops startup file

  • Executes dropped EXE

  • Modifies system executable filetype association

    persistence

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Adds Run key to start application

    persistence

  • Contacts third-party web service commonly abused for C2

    Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.

  • Enumerates connected drives

    Attempts to read the root path of hard drives other than the default C: drive.

  behavioral1behavioral2