Extracted

• • Target
    yazi.pdf.exe
  • Size 816KB
  • SHA256 6fd8a4c9816c99ca5ccae01c93337b19ddb47ed25ea5056ae9f729e968395bf8
  • MD5 667caf52dcfd114f7965807357386ae3
  • SHA1 570ddda49c29a3eb2c815d3b096812832758113f
  • SHA512 cfed0a6b535b43d2dcb314725d4409216f8e3f7c2d2369e17ef5a132747036539faaf9356d0fcc372e9c2cdca46ff301da8a71e9dca8700988f8ad148d8a766d
  • SSDEEP 12288:DuNAKJd77XtZfWH8XnGdHpcDZETa+fKGMMRSrbVFDF/ccGsOwoPhF0/fJ6L9FOds:DuNBLT+8ep8yT5wxF/MPhSR6pF
  • TLSH
    T140050288334ADD03C5A29FB00E71E3B455B91E88E810E713DBEABE97B87A7853D451D1
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  collectiondiscoveryevasionexecutionxwormpersistenceratspywarestealertrojan

  • Detect Xworm Payload

  • Family: Xworm

    Xworm is a remote access trojan written in C#.

    trojanratxworm

  • Modifies Windows Defender DisableAntiSpyware settings

    evasiontrojan

  • Command and Scripting Interpreter: PowerShell

    Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

    execution

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Drops startup file

  • Executes dropped EXE

  • Reads user/profile data of local email clients

    Email clients store some user data on disk where infostealers will often target it.

    spywarestealer

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Accesses Microsoft Outlook profiles

    collection

  • Adds Run key to start application

    persistence

  • Suspicious use of SetThreadContext

  behavioral1behavioral2