Extracted

• • Target
    xdd995ad01a999f6026c1015d0cfb7822642ebe1bf7155ee229fe86200fe13920.exe
  • Size 47.1MB
  • SHA256 dd995ad01a999f6026c1015d0cfb7822642ebe1bf7155ee229fe86200fe13920
  • MD5 0bfc73906c583108cf669bdffd7f0e34
  • SHA1 ea34252625a95bdfba502cb7cfc3b1a798a1ab6b
  • SHA512 c549de5605d0076e708b04a1931a5f4d9f8f30ce1f203d349c9faabf27d9fc91566795801ef3f9e98b8aabce29ddaaf7820d3604dc1913ef349aa58b7b74bb5a
  • SSDEEP 786432:mnJNoBpNAugxw7YySKRuFvIG+X2KT0txqE1VSrI8pQIS7dMlf7mB4JA+s61P3kK:mnI/Zrbo+AtxqyEIGQHdMlf7E4JA+s6N
  • TLSH
    T147B72312ABD44079F2F79271697A6275467ABC702F32CACF62803A5E1B74DD1D832723
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  discoveryxwormpersistenceratspywarestealertrojan

  • Detect Xworm Payload

  • Family: Xworm

    Xworm is a remote access trojan written in C#.

    trojanratxworm

  • Drops startup file

  • Executes dropped EXE

  • Modifies system executable filetype association

    persistence

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Adds Run key to start application

    persistence

  • Contacts third-party web service commonly abused for C2

    Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.

  • Enumerates connected drives

    Attempts to read the root path of hard drives other than the default C: drive.

  behavioral1behavioral2