Extracted

• • Target
    x3f19406e5a7eb9929e4322a605b968dd3171ba8751505e703ad4c049390d1cee.exe
  • Size 5.1MB
  • SHA256 3f19406e5a7eb9929e4322a605b968dd3171ba8751505e703ad4c049390d1cee
  • MD5 676dddf5f9f492a2f5f98911f14525ec
  • SHA1 23bf6923d361bf1ffb93a6eb7b18ac4265604037
  • SHA512 c3f66e76264a27a2928e52a845739d19b0e4cfab2d448459a651c81db4d21c6dc42a3e34203b90ff3036e6a71e4073de42bd936ce242e315f6bfb7d719212dde
  • SSDEEP 49152:VA+Cq99LyHHI+t6O8N+ailEy6dmpzeioK2enVzG1nkypHI+t6O8N+ailEy6dmpzk:70oAaldmdmnpNoAaldmdmnpd
  • TLSH
    T1B7363803A29548E9D29AC074CE46C131DB227C5D47F265FB3690BADA3E73AD43B3A711
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  xwormpersistenceratspywarestealertrojan

  • Detect Xworm Payload

  • Family: Xworm

    Xworm is a remote access trojan written in C#.

    trojanratxworm

  • Drops startup file

  • Executes dropped EXE

  • Modifies system executable filetype association

    persistence

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Adds Run key to start application

    persistence

  • Contacts third-party web service commonly abused for C2

    Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.

  • Enumerates connected drives

    Attempts to read the root path of hard drives other than the default C: drive.

  behavioral1behavioral2