Extracted

• • Target
    ech0-ac.exe
  • Size 71KB
  • SHA256 9acd419486311b42e861cd68057db896919a74152e4c60a053c7c9e2d8e5cf6e
  • MD5 a68d69b9840153bcbe6de6a64287b775
  • SHA1 d578a3873be160cdbed94302fd1b67ac5aefd054
  • SHA512 a0cb80d6a437236e022268af90e63c1ac58c90b2f20dc20ddd62f29638c67fd91491e2d751c24ca27a49ff0744607d1eb3fcce8e0ec4e02757c7e54ee9f88877
  • SSDEEP 1536:qXPfTzc29/A3+FX7ui83b9zzSa9pOPNaeAhEPy:qXvcFu51eb9/pOPN49
  • TLSH
    T1AF63391C27E24135E5FE6FB06CF26242D67AB21338039E5F64E7468B171BD888D506EB
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defense_evasionexecutionxwormpersistencerattrojanadwareransomwarespyware

  • Detect Xworm Payload

  • Family: Xworm

    Xworm is a remote access trojan written in C#.

    trojanratxworm

  • Boot or Logon Autostart Execution: Active Setup

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

    persistence

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Drops startup file

  • Executes dropped EXE

  • Adds Run key to start application

    persistence

  • Enumerates connected drives

    Attempts to read the root path of hard drives other than the default C: drive.

  behavioral1behavioral2