Extracted

• • Target
    x35750b06e4384a297a43f42dcf7f1bd029080d612917c2e1c9f0287be9c7bf18.exe
  • Size 533KB
  • SHA256 35750b06e4384a297a43f42dcf7f1bd029080d612917c2e1c9f0287be9c7bf18
  • MD5 00c8515e8cdd2abf472e91237eb08eaf
  • SHA1 d5a5de263e68cc29689e92cbfc9e56712d2e5627
  • SHA512 e529c824c1f2f53fc1e247fa5dc041b59c55658a2f43b3ef5b1ea11805ec273b273f159d72fa4d6ef601b37108a4138de9b2374d253a6854206c2c42976726f2
  • SSDEEP 12288:jYyDi5rNiQD+ysMFZzN/E/msumG7scQZd04T1eag9zQHi:EyngUGEZd04T1Y9zQC
  • TLSH
    T1B9C4AE15F78044FDD4AB8174C5E6465A9B39B88A0B31ADDF17CC432A2F227F08E397A5
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  discoveryxwormpersistenceratspywarestealertrojan

  • Detect Xworm Payload

  • Family: Xworm

    Xworm is a remote access trojan written in C#.

    trojanratxworm

  • Drops startup file

  • Executes dropped EXE

  • Modifies system executable filetype association

    persistence

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Adds Run key to start application

    persistence

  • Contacts third-party web service commonly abused for C2

    Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.

  • Enumerates connected drives

    Attempts to read the root path of hard drives other than the default C: drive.

  behavioral1behavioral2