Extracted

• • Target
    intelix.rar
  • Size 1.5MB
  • SHA256 eb2287494480622e0ad68af9810982f98ea33692fc197127602f5599adce06e4
  • MD5 89cbc6285ccf304e4fccbd2a145ab68e
  • SHA1 c33be9f1165bce5c07db2011f56ddafaac188c5e
  • SHA512 e1004646a398c3cf8a0251262af8f1f56c34291d9bc2561f74e6f6837f4b3b54a2dd42f47b10ab9579a9e4877e6b1bd73e13b5158ce2f7aced7de2a16d5345e1
  • SSDEEP 24576:AsY6Yy2ttt7yAumIY2/TCV36MprDOdgUS7ATwnHx7iCPzAzawPjxJ23ppg+q69Dm:tY1yAumItCV36ddgUSATwHtzk2Xg+lNY
  • TLSH
    T1D47533E86711B3D4E087DC6FC5249B0A32054E9A20AD983A470BD3FE59DF079F68DAD1
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  collectioncosturadiscoveryxorium_stealerpackerpersistenceprivilege_escalationspywarestealeradwareransomware

  • Detects XoriumStealer payload

  • Family: XoriumStealer

    XoriumStealer is an information stealer written in C#.

    stealerxorium_stealer

  • Boot or Logon Autostart Execution: Active Setup

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

    persistence

  • Executes dropped EXE

  • Reads WinSCP keys stored on the system

    Tries to access WinSCP stored sessions.

    spywarestealer

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Accesses Microsoft Outlook profiles

    collection

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery

  • Enumerates connected drives

    Attempts to read the root path of hard drives other than the default C: drive.

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  behavioral1behavioral2