Extracted

Extracted

• • Target
    VBCable_CD_PackSetup9.exe
  • Size 7.6MB
  • SHA256 0ccb142939a013fdd148a0d70bee3e6291be9f44418ce3645a11e6cc1f40e7a1
  • MD5 a293323f1c342cc0e2c884e906cd45fa
  • SHA1 aa25cfc8897e4d4cdef9e2a41f2ca0114c6d75e4
  • SHA512 3abe85d909c056a5c32c5f3ac95e59379e8cc7664da67fb04e83a2698e270893965f53cdd3650061479c6c114ff33ea373ad260f83b86adda8e28258e87bcb73
  • SSDEEP 196608:bNTHmss0kQcnbpGNj7b6m6Kn9drMjttsdS1hrkF:bNjmsBk1bkNvb6tKn36WdS
  • TLSH
    T18186CDD98DCC2826DB7C43AA68B46D913FDD4EA630BDA47C2D3406F06713186FD750AA
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defense_evasiondiscoveryexecutionxwormrattrojan

  • Detect Xworm Payload

  • Family: Xworm

    Xworm is a remote access trojan written in C#.

    trojanratxworm

  • Badlisted process makes network request

    Network request originating from process or tool commonly abused by malware.

  • Command and Scripting Interpreter: PowerShell

    Run Powershell and hide display window.

    execution

  • Command and Scripting Interpreter: PowerShell

    Using powershell.exe command.

    execution

  • Downloads MZ/PE file

  • Drops file in Drivers directory

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery

  • Indicator Removal: File Deletion

    Adversaries may delete files left behind by the actions of their intrusion activity.

    defense_evasion

  • Drops file in System32 directory

  behavioral1behavioral2