Extracted

• • Target
    PO23965 - 840 M-PORT.msi
  • Size 52KB
  • SHA256 1adcb42345c62c97e16ebf1217ed6405c0f5190c4ee8039dcb2d3231307cd57f
  • MD5 7f4fad4fe5b5ed9b3317bc9872a07b0d
  • SHA1 1a1338bd4c160d592c72f8951be526ebd46e1550
  • SHA512 16425965138ee490e9910216e2e69bd2505d18d415803178dc57d113f7bf13e850f18bea77f008c9fa2f00b03384c85408a9bc78379728b38a24b33acddebd94
  • SSDEEP 768:zvinDc37YwuRic7yElJXqy6H4VM8Nrkp6qCGvkxC:jinDc37ugc7r//UCt
  • TLSH
    T134337E03B744A332D58307724E2FC7E49F7AAC048FF395167696B34C1E71A9016ABAE1
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  collectiondefense_evasionexecutionxwormpyinstallerransomwareratspywarestealertrojanupx

  • Detect Xworm Payload

  • Family: Xworm

    Xworm is a remote access trojan written in C#.

    trojanratxworm

  • Command and Scripting Interpreter: PowerShell

    Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

    execution

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Reads user/profile data of local email clients

    Email clients store some user data on disk where infostealers will often target it.

    spywarestealer

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Accesses Microsoft Outlook profiles

    collection

  • Enumerates connected drives

    Attempts to read the root path of hard drives other than the default C: drive.

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  behavioral1behavioral2