Extracted

• • Target
    SH 397563465 7562378 DOC 76442H PDF.JS
  • Size 3.0MB
  • SHA256 537e1344383c4770c0e6e0c946ef0864c2ccafea3dc8c91d489054f64106c6e1
  • MD5 99c560fb1cdd744d15fc89a2023546a3
  • SHA1 d5197bed4a8eaf86e93b17db7e290d9b09defb7c
  • SHA512 8126f41ae0a1f08c9594c599b89c91c2fe6257ceef08516bc04e5bf25b5009464a06cc4c56beb92f7dda636f26ffeb50754acd09cda332fbc92aee21ae43b85e
  • SSDEEP 49152:yXITHSfqLA5GFUxz65xDfh7wboBnH4SR3ynCt4vCM14zInfEFu2Fd0YTsIGrJOzq:JTHSfqLA5GFUxz65xDfh7wboRYSR3ynP
  • TLSH
    T10FE583406B90E6357A6DB31CF67274316A0593D758C8EB2D303CD108BB3B99B636C9E9
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  collectiondiscoveryexecutionxwormratspywarestealertrojan

  • Detect Xworm Payload

  • Family: Xworm

    Xworm is a remote access trojan written in C#.

    trojanratxworm

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Reads user/profile data of local email clients

    Email clients store some user data on disk where infostealers will often target it.

    spywarestealer

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Accesses Microsoft Outlook profiles

    collection

  • Suspicious use of NtSetInformationThreadHideFromDebugger

  behavioral1behavioral2