Extracted

• • Target
    work.exe
  • Size 261KB
  • SHA256 54272a544c0598e4e6c2db30ce846b87838a5cd7251471bd635a5a4828450693
  • MD5 588550d3dc38a2f4595945abe51cb937
  • SHA1 c0481ac5808c2711d248568952d3ecdcb163a0ce
  • SHA512 9c20e5b78fab82e9f172be2eb38044a97a6c2cda5e6ee8b5d7da0f66a448e1b0787e23a3786a43ff10b7de8f1b3584fa7b495463cfef510e9275f7879643d4f2
  • SSDEEP 3072:372f5wG2w0GVK6EZFH03jXGD+GFxsxvZmbN5zvfyeirKZyRvX/F13N4fQ1k6Yz:BTrZFH03ShPKZmb7CprKZ+/B4fQI
  • TLSH
    T15B44076837FC0619F3BF8B715BB8659C4AB6F467E915D26C288220DD2E71B809D50B33
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  collectiondiscoveryexecutionxorium_stealerpersistenceprivilege_escalationspywarestealer

  • Detects XoriumStealer payload

  • Family: XoriumStealer

    XoriumStealer is an information stealer written in C#.

    stealerxorium_stealer

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Drops startup file

  • Executes dropped EXE

  • Reads WinSCP keys stored on the system

    Tries to access WinSCP stored sessions.

    spywarestealer

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Accesses Microsoft Outlook profiles

    collection

  • Adds Run key to start application

    persistence

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  behavioral1behavioral2