Extracted

• • Target
    x6316ad362ae3a89a237b9a3a4921afdce4a7232708cee3ab4480f13d5e664abb.exe
  • Size 4.0MB
  • SHA256 6316ad362ae3a89a237b9a3a4921afdce4a7232708cee3ab4480f13d5e664abb
  • MD5 8958d02e0c008d5cf937f9583796af37
  • SHA1 9a7320d3f485ca7fa61807a118e9bdb38afccbfa
  • SHA512 5ce211399680e5054730faeb224eeb13afbcab96dceb4e9194495ee5f990ebc69f0981c46cff6c6ee16343cfc2a58a43cb20f85c5b3789e7b59f1ddfee7c373b
  • SSDEEP 49152:VSI/rjmfzlBjwWmsI8p6067WAge6jt/WDPDQ32a17mo6evQDtB75IlwDnlop04Mp:vH0jwWmc12Og/tn
  • TLSH
    T19D165C51A3E841E6E1BBD278897A8633EBB2BC571670A78F0664C52B0F736205F3D711
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  xwormpersistenceratspywarestealertrojan

  • Detect Xworm Payload

  • Family: Xworm

    Xworm is a remote access trojan written in C#.

    trojanratxworm

  • Drops startup file

  • Executes dropped EXE

  • Modifies system executable filetype association

    persistence

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Adds Run key to start application

    persistence

  • Contacts third-party web service commonly abused for C2

    Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.

  • Enumerates connected drives

    Attempts to read the root path of hard drives other than the default C: drive.

  behavioral1behavioral2