Extracted

• • Target
    e14a32aaaa2b8610197b48e8cd566f9a913688c69dffc2666bd676a881005e43.exe
  • Size 407KB
  • SHA256 e14a32aaaa2b8610197b48e8cd566f9a913688c69dffc2666bd676a881005e43
  • MD5 5270fcafecaec9c59785dc8f6a316b70
  • SHA1 fb25d459e5c5d4582b7457e714b9fbec32da7476
  • SHA512 7755dc93c5da380d462ed009a2b633bf326a7a5dd3f55e2291fdad0111b03ee462fb58dffb734ee2b2f31425b184913eccd9400c3108dd8665d11859283565a0
  • SSDEEP 6144:k6bAcJuMn7pb+YwPk54PCHuh46MPnoEw6uVWcH+v8w5lVenN:rbNKu4PCHuhOLuTZw5lVc
  • TLSH
    T13094F1023710D66AC8EA9A3B8C4B97E64B50FD585B509F177364BB3F3DF26019A0E385
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defense_evasiondiscoveryexecutionxwormpersistencepyinstallerratspywarestealertrojanupxcollection

  • Detect Xworm Payload

  • Family: Xworm

    Xworm is a remote access trojan written in C#.

    trojanratxworm

  • Executes dropped EXE

  • Loads dropped DLL

  • Reads user/profile data of local email clients

    Email clients store some user data on disk where infostealers will often target it.

    spywarestealer

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Accesses Microsoft Outlook profiles

    collection

  • Adds Run key to start application

    persistence

  • Suspicious use of NtCreateThreadExHideFromDebugger

  • Suspicious use of NtSetInformationThreadHideFromDebugger

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  behavioral1behavioral2
• • Target
    $PLUGINSDIR/System.dll
  • Size 11KB
  • SHA256 c2f405d7402f815d0c3fadd9a50f0bbbb1bab9aa38fe347823478a2587299448
  • MD5 9625d5b1754bc4ff29281d415d27a0fd
  • SHA1 80e85afc5cccd4c0a3775edbb90595a1a59f5ce0
  • SHA512 dce52b640897c2e8dbfd0a1472d5377fa91fb9cf1aeff62604d014bccbe5b56af1378f173132abeb0edd18c225b9f8f5e3d3e72434aed946661e036c779f165b
  • SSDEEP 192:eX24sihno00Wfl97nH6BenXwWobpWBTtvShJ5omi7dJWjOlqSlS:D8QIl972eXqlWBFSt273YOlqz
  • TLSH
    T1BD325D06235081F3E1914138846B3E175F6A15069BF58E97DFD38646BE30BE7BD79503
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  8^/10

  discoveryadwarepersistenceransomwarespyware

  • Boot or Logon Autostart Execution: Active Setup

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

    persistence

  • Enumerates connected drives

    Attempts to read the root path of hard drives other than the default C: drive.

  behavioral3behavioral4