Extracted

• • Target
    echoac-scan.exe
  • Size 67KB
  • SHA256 e1e51dcf4349e7374bd1ac99511fc44f3b82effbb3a67c4b73080ffc54b87873
  • MD5 f42b96149d3d67a1ed6d59d84768db7c
  • SHA1 095b06f4164692ad9983df29aee7861cde0d4e9b
  • SHA512 e2dd2c3569b09a24734222c0097fd79176d112d28f7f87da04665913f6d808002b3883454d147812b3f62ce9f48411985cc5131a38d3831dbaebc21184de0abe
  • SSDEEP 1536:FnqqpgJ1W1weuY/bQmYpSBWNiOSx5RB4mI:Fm2weD/bQm7WsOqDM
  • TLSH
    T120635B1C33B54135E9EE9FB55CB222128675F61379038F4F18EB0A871B2ADC8CA516E7
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  executionxwormpersistencerattrojanadwaredefense_evasiondiscoveryransomwarespyware

  • Contains code to disable Windows Defender

    A .NET executable tasked with disabling Windows Defender capabilities such as realtime monitoring, blocking at first seen, etc.

  • Detect Xworm Payload

  • Family: Xworm

    Xworm is a remote access trojan written in C#.

    trojanratxworm

  • UAC bypass

    defense_evasiontrojan

  • Boot or Logon Autostart Execution: Active Setup

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

    persistence

  • Disables RegEdit via registry modification

    defense_evasion

  • Disables Task Manager via registry modification

    defense_evasion

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Drops startup file

  • Executes dropped EXE

  • Adds Run key to start application

    persistence

  • Checks whether UAC is enabled

    defense_evasiontrojan

  • Enumerates connected drives

    Attempts to read the root path of hard drives other than the default C: drive.

  • AutoIT Executable

    AutoIT scripts compiled to PE executables.

  • Sets desktop wallpaper using registry

    ransomware
  behavioral1behavioral2