Extracted

• • Target
    Crack_voicemod_pro.exe
  • Size 437KB
  • SHA256 7b28197bae5a7b1adce270e7a30cde871acdccf41510202f2c0239a7f98ca2f3
  • MD5 4f3a50fdb1eb2ad2c0b4b50faf1cfdd5
  • SHA1 5d50ea0ae781f418873fdbd265e25d1762d9c9c8
  • SHA512 82ad2347158c93b7176564b2c30d769cb97abf088a304f134a8e7af13cd565c078bfd439ae8bd97bf9bdf3a2ac073a10de4043b5672ede93ff1ee4b387129e2d
  • SSDEEP 12288:EdMJThXZqORel0NgsHNS/3r8XrIeK4h1HyJjZW:Ed09cORe06sKb8bIeKgHh
  • TLSH
    T17594232C73D60767D669AD742D63FA9443AB905AF297A69FB000D906FF1A0ECD0D3213
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  collectiondefense_evasiondiscoveryexecutionxorium_stealerpersistenceprivilege_escalationspywarestealertrojan

  • Detects XoriumStealer payload

  • Family: XoriumStealer

    XoriumStealer is an information stealer written in C#.

    stealerxorium_stealer

  • Modifies WinLogon for persistence

    persistence

  • Identifies VirtualBox via ACPI registry values (likely anti-VM)

    defense_evasion

  • Looks for VirtualBox Guest Additions in registry

    defense_evasion

  • Event Triggered Execution: AppInit DLLs

    Adversaries may establish persistence and/or elevate privileges by executing malicious content triggered by AppInit DLLs loaded into processes.

    persistenceprivilege_escalation

  • Looks for VMWare Tools registry key

    defense_evasion

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Reads WinSCP keys stored on the system

    Tries to access WinSCP stored sessions.

    spywarestealer

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Accesses Microsoft Outlook profiles

    collection

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Checks system information in the registry

    System information is often read in order to detect sandboxing environments.

  • Drops file in System32 directory

  behavioral1behavioral2