Extracted

• • Target
    _40f84ae721a13a383e13d18ba0d4cd120db5fe61fae4eefc117347fa6d1a4352.txt
  • Size 305KB
  • SHA256 40f84ae721a13a383e13d18ba0d4cd120db5fe61fae4eefc117347fa6d1a4352
  • MD5 cc5eef48d8137eef70410515ae974aea
  • SHA1 9a297bdf2e2014743cc76739b71af175e27a9a66
  • SHA512 5b5cf77c4008af1554ad6f0a1abfb9b0630456bc72458fe92c879e74b875e5de4b1e27f62f2f71efe7296eb152f985a96468dc688ea1181df91172070120ac4c
  • SSDEEP 6144:ZrObwammarKkMF6Lm6X0SbVbMVkksSS4iaV3KY:ZrObkmog+/VwV3vVF
  • TLSH
    T10464D0082BC1B9728BD9943F247F926EEE3D4C869644D0C8F757F884FDB53069627288
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defense_evasiondiscoveryexecutionxwormpersistencepyinstallerratspywarestealertrojanupxadwareransomware

  • Detect Xworm Payload

  • Family: Xworm

    Xworm is a remote access trojan written in C#.

    trojanratxworm

  • Boot or Logon Autostart Execution: Active Setup

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

    persistence

  • Command and Scripting Interpreter: PowerShell

    Using powershell.exe command.

    execution

  • Command and Scripting Interpreter: PowerShell

    Run Powershell and hide display window.

    execution

  • Drops startup file

  • Executes dropped EXE

  • Loads dropped DLL

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Adds Run key to start application

    persistence

  • Enumerates connected drives

    Attempts to read the root path of hard drives other than the default C: drive.

  • Suspicious use of SetThreadContext

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  behavioral1behavioral2