Extracted

• • Target
    3z9AHWx-67450-08b2F9D1829497BCF4A686b9684.txt
  • Size 6KB
  • SHA256 13956430479829bc40ac0a1b49a04133734030c3a07a904f597229d4b16d8af7
  • MD5 9bc43ec0603cc0f7694272e5c564698b
  • SHA1 f8a1c52a91842ed3ea3dfebc755999163dd72f07
  • SHA512 264110a23a621ed68f2aedef32a4dc7d01da7305a226b8ae4faac2806468b0a8f8fcafd91245020bb482def97f18104e11acdd925445ae3309286f93239bad9e
  • SSDEEP 96:y0amSw8ZanOgxTtNXN8IukeSUSipTDg9Jw2VxPiCb7DWQFumNBWS/MdOJFZvWGe:+mSvYTtNXNG3g8i9rjWQFuzS/wO9vWv
  • TLSH
    T155D16EF2858E48984F41E76D3CC1F7961D3A2B8314C9ACB0486D2B47459B67B87FC789
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  8^/10

  adwarespywarepersistenceransomware

  • Boot or Logon Autostart Execution: Active Setup

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

    persistence

  • Enumerates connected drives

    Attempts to read the root path of hard drives other than the default C: drive.

  behavioral1behavioral2
• • Target
    PRO840423SG8_XEZC_1892192.LZH
  • Size 2KB
  • SHA256 2f89acf0a56b00a1e1e20f754699df12ee350c70029988892ba4a93e3996bab0
  • MD5 f2a77cf955e47115324a6ed15de37ec7
  • SHA1 e7bbaccff4e71f46ac14b30bf7b532b823dcb3e2
  • SHA512 83f59dfc1a99416e53add406e368cc9e3375402d8734b1d8dbb4f802d456357105cc5651359b0020ffe75a0a158927fce251fe83abe2d05357dcdd7ffe595ded
  • TLSH
    T111512C7F8C9A1A7AEB5A2831A6AD7C276B920C59FC4264757691335250CE181B307D33
  • MD5 SHA1 SHA512 TLSH

  Score

  8^/10

  adwarepersistencespyware

  • Boot or Logon Autostart Execution: Active Setup

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

    persistence

  • Enumerates connected drives

    Attempts to read the root path of hard drives other than the default C: drive.

  behavioral3behavioral4
• • Target
    PRO840423SG8_XEZC_1892192.js
  • Size 2.1MB
  • SHA256 b37f25845dccefc3919ec843f8fe2f8b761ebe7a16055911e3d116b3e5fe21f5
  • MD5 4499ab60d42d1d8050efde6cf567be8a
  • SHA1 604b37b713487876b3380cdf67fa26260c342cfc
  • SHA512 fe5007a85ca95bb93a3ed6c0d34fc4b9a8b8d82d2f576b3a57c37c319fe8ca499c3afbef4235a58b29fa00e11b12f13220a1d3504db0c2adc9a307cdab090653
  • SSDEEP 192:AbwWBKm05P39UJg97KGn+oyTHIZAUkvlrK:AcWBKm05P39UJg97Kw+oyTHIZAUkvE
  • TLSH
    T1DCA57BD6226FED85D0965603164F525ACEBC46728F1BE39CB90DDFC81028599E2F0CEE
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  discoveryexecutionxwormpersistencerattrojanadwareransomwarespyware

  • Detect Xworm Payload

  • Family: Xworm

    Xworm is a remote access trojan written in C#.

    trojanratxworm

  • Process spawned unexpected child process

    This typically indicates the parent process was compromised via an exploit or macro.

  • Badlisted process makes network request

    Network request originating from process or tool commonly abused by malware.

  • Boot or Logon Autostart Execution: Active Setup

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

    persistence

  • Enumerates connected drives

    Attempts to read the root path of hard drives other than the default C: drive.

  • Suspicious use of SetThreadContext

  behavioral5behavioral6
• • Target
    email-html-1.txt
  • Size 220B
  • SHA256 33ad20caf5453581632b9aac5c911d9ce4b40d766fd571325d078800e20d2040
  • MD5 1cbf1ed0c6ae9656e67888c4687ee494
  • SHA1 510f10c1dacb8e0b6219cb6c1daebe0b945d97af
  • SHA512 426bf526b3791b249b6676ad49ce467212779aca2a410a3e4afc18a300b4a996b1064f7c566211bfc336262cd9a82e18c5f9d444147eb464c3566f30ca09b187
  • TLSH
    T12DD0A7DBE2523C06D530167065C167C6614A179091850930615072D738C5930C69338E
  • MD5 SHA1 SHA512 TLSH

  Score

  4^/10

  discovery
  behavioral7behavioral8