Extracted

• • Target
    yazi.pdf.exe
  • Size 839KB
  • SHA256 d073fb2faae776d80e0cf2c5720da618295daca356a706382c02fb64f4b838ba
  • MD5 4cf6f56fb7c4682b1037cfef577a3a06
  • SHA1 9b47019c2443829bd419f6713ff4ddd6b7d012a6
  • SHA512 8020bd2f11c2fd90ab7fd0f9724fba8b69083c2219b8a367ff2ce627f4d4d584ec44da8e95b4b0ca9e118f590097afdc17ff533f3162cd82fa2992e8be2933a1
  • SSDEEP 12288:9IAlxe0/fJ6L9FOdMpeRKrOaH91w4wpe8het/new+zm97vwACyh+:nzjR6pFsRKiqE4cOt/WzkwAh+
  • TLSH
    T19B050114335ADC02C5D36FB11D70D37911B99E88B815E373DEFABCABB83E6866911281
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  collectiondiscoveryevasionexecutionxwormpersistenceratspywarestealertrojan

  • Detect Xworm Payload

  • Family: Xworm

    Xworm is a remote access trojan written in C#.

    trojanratxworm

  • Modifies Windows Defender DisableAntiSpyware settings

    evasiontrojan

  • Command and Scripting Interpreter: PowerShell

    Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

    execution

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Drops startup file

  • Executes dropped EXE

  • Reads user/profile data of local email clients

    Email clients store some user data on disk where infostealers will often target it.

    spywarestealer

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Accesses Microsoft Outlook profiles

    collection

  • Adds Run key to start application

    persistence

  • Suspicious use of SetThreadContext

  behavioral1behavioral2