Extracted

• • Target
    888Cry55pto_18Layer_DefenderKill.exe
  • Size 16.0MB
  • SHA256 730afe6605cfb0e3791276199c49d2af11585c5d470ee6f4c318040faf53f1a7
  • MD5 f2f9bb757d2dbed7d8fd6bff97b7b63a
  • SHA1 714d2136863d0ce96495381863289124a4dcad1c
  • SHA512 99866178bd5d9606344701197d9e7fbc05173a5fe43acca29366b97c79162b4764f856c1cd29398294921b0f2f3d6cd969ed7dcfcd19527bdf49ebd7feca124e
  • SSDEEP 393216:3idCbOKPvzSKu5XMCHWUj6KOrPw1/15akIlyWZV:3ZiKPvzI5XMb86KFEB
  • TLSH
    T1F9F63316A3B194E6E8E36936599BC549C177BC201365C9CB43A8323D2EB70D46F3CF62
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  adwaredefense_evasiondiscoveryevasionexecutionxwormpersistencephishingratspywarestealertrojan

  • Detect Xworm Payload

  • Family: Xworm

    Xworm is a remote access trojan written in C#.

    trojanratxworm

  • Modifies Windows Defender DisableAntiSpyware settings

    evasiontrojan

  • Modifies Windows Defender Real-time Protection settings

    defense_evasiontrojan

  • Modifies security service

    defense_evasion

  • UAC bypass

    defense_evasiontrojan

  • Command and Scripting Interpreter: PowerShell

    Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

    execution

  • A potential corporate email address has been identified in the URL: [email protected]

    phishing

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Adds Run key to start application

    persistence

  • Checks whether UAC is enabled

    defense_evasiontrojan

  • Drops desktop.ini file(s)

  • Installs/modifies Browser Helper Object

    BHOs are DLL modules which act as plugins for Internet Explorer.

    stealeradware

  • Modifies Security services

    Modifies the startup behavior of a security service.

    defense_evasion

  • Obfuscated Files or Information: Command Obfuscation

    Adversaries may obfuscate content during command execution to impede detection.

    defense_evasion

  • Suspicious use of SetThreadContext

  behavioral1behavioral2