Extracted

• • Target
    Vape 4.19.exe
  • Size 41KB
  • SHA256 6330dcb6ccedc3ddad57967c3fd555b055f94ad548c2e0d8100b1480d49fd78f
  • MD5 44153bc70d26301c2dbf83a35bf6118f
  • SHA1 98646bc2f2c88509a6b2cc35f80b402d979f8f37
  • SHA512 fb01b93fc903eaf20a68ce779d026e40f1771a72dc402e5ff8e75106c32c9e3aca19c177dd5b70cb0b5cfeaa4843cd5592c3ee58d2f30335c8818648897f335e
  • SSDEEP 768:gUDlQj1Zx5qtBk8womL1NlJF5Pr9p5klG6iOwhc3/Sv:gU6ZxEXvBILFp9TklG6iOwuc
  • TLSH
    T1FE1339057B918625E5FEABB519B266070731E6038E23D79E0CD892DB1B6BBC0CE407D7
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  discoveryexecutionxwormpersistenceprivilege_escalationrattrojan

  • Detect Xworm Payload

  • Family: Xworm

    Xworm is a remote access trojan written in C#.

    trojanratxworm

  • Command and Scripting Interpreter: PowerShell

    Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

    execution

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Creates a file in the Startup directory

    A file was written to a Windows startup folder. Files in these directories are executed automatically when a user logs on or an application initializes.

    persistenceprivilege_escalation

  • Executes dropped EXE

  • Adds Run key to start application

    persistence

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

    discovery
  behavioral1behavioral2
• • Target
    penis.dll
  • Size 13.7MB
  • SHA256 43db523c080d4b4d3077c631f471fd35d8b737c9863f1e01e9dd536cb4879f7a
  • MD5 6494b559c1d47c6ceb16030b63513994
  • SHA1 4f65b798ad2fe45c78011e4f300c95134fddefb1
  • SHA512 c45c504db69f6213a418afea4efaf1e156fe0a572f5755ae91667917465d162055c7ce433219983c6a5d9dd9362451c01049bf3085019876b80d3c54d3a793b9
  • SSDEEP 196608:pQVIRyXspnKu3zJrSPBuQTFOMF9rjFLYQ7bdYSTTSdejRvmpCk3DZlkgaQQjkEC0:lhpDJrWB7vv5B1ThOpC+AsM7cQ
  • TLSH
    T162E61229BDC5F569D187A13110528023BB2870CEE14BE17B06EC65AB5E73D960F13FEA
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  1^/10
  behavioral3behavioral4