Extracted

• • Target
    x2077898fbe34d060ff9364af198e147a7275068d402fe544abc21dff6346323f.exe
  • Size 961KB
  • SHA256 2077898fbe34d060ff9364af198e147a7275068d402fe544abc21dff6346323f
  • MD5 ef9849ccc83eb1cd3827529025e9c2dd
  • SHA1 9680e5af1eedaad61abb5208c669af559663d245
  • SHA512 66214c7c6835227616d77ed82593a9cd2c0f3dd5a667f834183855361ad634ca71bf77d7ca1653191da93803642ba0512c6879db6623d2ad204f0130bf88910c
  • SSDEEP 24576:EyvgUGhxcVUzdm2SrGx0cxcVUzdm2SrGx0i:qa8Y2Sr+68Y2Sr+5
  • TLSH
    T19025BE12F79148B6E5B3453149B596629E7DBC620B31DEEF13C8062E5F326D0CE39B22
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  xwormpersistenceratspywarestealertrojan

  • Detect Xworm Payload

  • Family: Xworm

    Xworm is a remote access trojan written in C#.

    trojanratxworm

  • Drops startup file

  • Executes dropped EXE

  • Modifies system executable filetype association

    persistence

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Adds Run key to start application

    persistence

  • Contacts third-party web service commonly abused for C2

    Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.

  • Enumerates connected drives

    Attempts to read the root path of hard drives other than the default C: drive.

  behavioral1behavioral2