Extracted

Extracted

• • Target
    SillyClient.exe
  • Size 70KB
  • SHA256 30f6f21eb023ab26e22a5749344c177b4eadabaffe60557526954cc26318b3b9
  • MD5 e00164e7b7c62bb1ecc114eda5957b02
  • SHA1 8813dacc3b0b19d2afc9c8eb96001796890abfbf
  • SHA512 77b37bddaeb0ac6a0915f788f13de00f146fcf40a5b1d4df16d2d4265484541f850261f336dc3024e1c159691b74a48be7cbb7a8ecb5e9673169e4b42378fec3
  • SSDEEP 1536:JOOCFKpZ+rseSqpbXW5K1bgaUFkYPz11V7G1ODCmu:JOO1n+r/xp1bgfkYr11V7G1OD7u
  • TLSH
    T12A634A5CAB944122D1BFAAF168B3928F8735B9E34402D54E2CD841D66B337E85684EF3
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  bootkitdefense_evasionexecutionxwormpersistencerattrojan

  • Detect Xworm Payload

  • Family: Xworm

    Xworm is a remote access trojan written in C#.

    trojanratxworm

  • Sets service image path in registry

    This determines the executable launched when a service starts. It can be used to establish persistence.

    persistence

  • Checks BIOS information in registry

    BIOS information is often read in order to detect sandboxing environments.

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Drops startup file

  • Executes dropped EXE

  • Indicator Removal: Clear Windows Event Logs

    Clear Windows Event Logs to hide the activity of an intrusion.

    defense_evasion

  • Adds Run key to start application

    persistence

  • Contacts third-party web service commonly abused for C2

    Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.

  • Enumerates connected drives

    Attempts to read the root path of hard drives other than the default C: drive.

  • Writes to the Master Boot Record (MBR)

    Bootkits write to the MBR to gain persistence at a level below the operating system.

    bootkitpersistence

  • Drops file in System32 directory

  behavioral1behavioral2