Extracted

• • Target
    KEYSER v2.2.rar
  • Size 13.3MB
  • SHA256 283cfc6ef2e0183ff0bc3509d52f31baf8a46a2f7c892239a0f3e067c2daa22d
  • MD5 162192e1de637defd373168c3fdde857
  • SHA1 f064c4f74393d427311aa8bca99b367be866daa1
  • SHA512 19b0a798a580ae12df50f9ed6290964b59ea3d3b83605ae9323a44e6fc25aa0d5edc415459808e36b68e4ae9f1dbd8ca316340b9b588e40b797e43617cb57916
  • SSDEEP 393216:1oT4+fqm8ry+SfHPosWv9gCoV7lxuCKD+:ukC8riPofv98NRi+
  • TLSH
    T1C0E6331B31392B29DC563B38A6B71B032B9CC6CD514F6471F903C7B90B89D24B8A75E6
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  8^/10

  adwarepersistenceransomwarespyware

  • Boot or Logon Autostart Execution: Active Setup

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

    persistence

  • Enumerates connected drives

    Attempts to read the root path of hard drives other than the default C: drive.

  behavioral1behavioral2
• • Target
    KEYSER v2.2.exe
  • Size 13.3MB
  • SHA256 1ccffc4a3809ce3142d0d3a2141f510537252890a91c4dfc3995a0f2dc02af2d
  • MD5 64e213e4de3204642b26648fc70350b0
  • SHA1 00568ee66930fe3d269cca348c830d603a2ce881
  • SHA512 043db5b9132b9b90c698f7c98ec441c9d6339cc9ddfe969087cca70bf52abb40c1cd2143f641412c11b2f9ca0d03f96b4efc2575099f9774ef8a99de22874f26
  • SSDEEP 393216:XoT4+fqm8ry+SfHPosWv9gCoV7lxuCKD:YkC8riPofv98NRi
  • TLSH
    T125E6331B31392B29DC563B38A6B71B032B9CC6CD514F6471F903C7B90B89D24B8A75E6
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  xwormrattrojanadwarepersistenceransomwarespyware

  • Detect Xworm Payload

  • Family: Xworm

    Xworm is a remote access trojan written in C#.

    trojanratxworm

  • Boot or Logon Autostart Execution: Active Setup

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

    persistence

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Enumerates connected drives

    Attempts to read the root path of hard drives other than the default C: drive.

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Suspicious use of NtSetInformationThreadHideFromDebugger

  behavioral3behavioral4