Extracted

• • Target
    888Cry55pto_InstantBoot_Signed.exe
  • Size 140.1MB
  • SHA256 2911a6d2b2306644cbb01d5d2d2f982e23fece8d6cfcad2feba1430b38733277
  • MD5 230c6513ea6f6018d3eac67b7b243d06
  • SHA1 ccbed49f0d2ded757f60807c846dc47a15f9cad5
  • SHA512 d2101b906894855c3faa3ccd5857a8d6514fd66bc946d13e1d10dccfcd62d0ca8991337262d1959d4c036fc4903c83b981170fc915b60b110b6545ff13f23f5a
  • SSDEEP 3145728:gR0DByYF8A+cbKjDacRW68vD13iPnbOue5VYWZ0ehPNSruHXdN:JMYlbKyP/vxiPKnYKhPIraX
  • TLSH
    T1CD68339C51E097D3E68302B9C733F20D2542BA464715E9D727A4AE818E365CC9FBD2B3
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  adwaredefense_evasiondiscoveryevasionexecutionxwormratspywarestealertrojan

  • Detect Xworm Payload

  • Family: Xworm

    Xworm is a remote access trojan written in C#.

    trojanratxworm

  • Modifies Windows Defender DisableAntiSpyware settings

    evasiontrojan

  • Modifies Windows Defender Real-time Protection settings

    defense_evasiontrojan

  • Modifies security service

    defense_evasion

  • Command and Scripting Interpreter: PowerShell

    Run Powershell to get system information.

    execution

  • Command and Scripting Interpreter: PowerShell

    Using powershell.exe command.

    execution

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Reads ssh keys stored on the system

    Tries to access SSH used by SSH programs.

    spywarestealer

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery

  • Hide Artifacts: Hidden Window

    Windows that would typically be displayed when an application carries out an operation can be hidden.

    defense_evasion

  • Modifies Security services

    Modifies the startup behavior of a security service.

    defense_evasion

  • Obfuscated Files or Information: Command Obfuscation

    Adversaries may obfuscate content during command execution to impede detection.

    defense_evasion

  • Suspicious use of SetThreadContext

  behavioral1behavioral2behavioral3