Extracted

• • Target
    HotmailSoftware_v20260626.6.exe
  • Size 98.5MB
  • SHA256 c78de6f35bb713e25f1233a95edcdca5fe41e437e4b10db881fae68f06f5efc8
  • MD5 0e6d7c6b3c24cd4ac9f59131bed33ec3
  • SHA1 4fb7c3dbbcaa620960179c4b304d3b7cc5339744
  • SHA512 4182ab933610e668dc8f1b83bcddde7d72fefa9acbe66b811c3dd3db855ec56728ec824af8bf2bea33d30035b7cb438cd5d8997b6258fc6ccccf164fc65bd5c2
  • SSDEEP 49152:gZFb6PzgRvClmNFsoZS1cfVKP6AcJehdc4K2nVhJHLeL91XN2rjWHagtKd9g4KDO:
  • TLSH
    T1583833106E696E7E8A6CC33C30BF1E1D2BE10F859459F1EF5AE174C7129EF41452B82A
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defense_evasionexecutionblankgrabberxwormpersistenceprivilege_escalationratstealertrojan

  • A stealer written in Python and packaged with Pyinstaller

  • Detect Xworm Payload

  • Family: Xworm

    Xworm is a remote access trojan written in C#.

    trojanratxworm

  • Family: blankgrabber

    Blankgrabber is an infostealer written in Python and packaged with Pyinstaller.

    stealerblankgrabber

  • Command and Scripting Interpreter: PowerShell

    Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

    execution

  • Modifies RDP port number used by Windows

  • Modifies Windows Firewall

    defense_evasion

  • Executes dropped EXE

  • Loads dropped DLL

  • Adds Run key to start application

    persistence

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  behavioral1