Extracted

• • Target
    ech0-ac.exe
  • Size 66KB
  • SHA256 753296c9be62f63acecd9daa20a3ac55daae786a6d10060c564c83ea0d12f002
  • MD5 75971c2f54b2f5caef175eb3f163679a
  • SHA1 e707476239f197358f8a77449650ed75add6a6b8
  • SHA512 a42c8b75884bdbd4227555a82eb4b67e13e2199b6e325a7b4b8af5409167ff386457a43a29e41c5142ee824d82b3c3aca29240bf624b30ae8d8cc8e00aafd7ee
  • SSDEEP 1536:8k8LCwzrqRoGZl/bs6RcbpQwVsONKLO5xOnj:8iwHQZl/bJMVNyO5xOj
  • TLSH
    T128636C287BE68129F0FFAFB559F23156C77AB3235812C75F24D8028A0713989C9417FA
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  executionxwormpersistencerattrojanadwareransomwarespyware

  • Detect Xworm Payload

  • Family: Xworm

    Xworm is a remote access trojan written in C#.

    trojanratxworm

  • Boot or Logon Autostart Execution: Active Setup

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

    persistence

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Drops startup file

  • Executes dropped EXE

  • Adds Run key to start application

    persistence

  • Enumerates connected drives

    Attempts to read the root path of hard drives other than the default C: drive.

  behavioral1behavioral2