Extracted

• • Target
    products.exe
  • Size 66KB
  • SHA256 b4a3205341b7d6eee7d8a810300a39960ac66c7fb89f585a06c6e1e921a49820
  • MD5 650f23885fb2959893108950df8e1e22
  • SHA1 9386b1a0b191f56cf4cf6669303b507d7f72201d
  • SHA512 b6ef661d780148b528e7cef327ab4dd71e57a237ea950e27f42d7b7634731ff2b505cab04af83c205702b18d820836e6a40fa8e3ce8549b2c31cc7540bd8a6d0
  • SSDEEP 768:wNOlPy66++RRbQdTXded6k5GKMFg9WIV6POAhsdegcJ/WNrKM5Mm67l:oOsj3QdTX6CFg9WIV6POA+cfRWJIl
  • TLSH
    T1DA6380CABF848D10D9AD97F104621286063DFD86D423974F07A875E65E3BD838A73ED2
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  collectionexecutionxwormpersistenceratspywarestealertrojan

  • Detect Xworm Payload

  • Family: Xworm

    Xworm is a remote access trojan written in C#.

    trojanratxworm

  • Command and Scripting Interpreter: PowerShell

    Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

    execution

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Drops startup file

  • Executes dropped EXE

  • Reads user/profile data of local email clients

    Email clients store some user data on disk where infostealers will often target it.

    spywarestealer

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Accesses Microsoft Outlook profiles

    collection

  • Adds Run key to start application

    persistence
  behavioral1behavioral2