Extracted

• • Target
    2c466f7bc985e031913991fad6a0e3a7deb12dbacf71a052a6a9e28804d74e0c.bin
  • Size 418KB
  • SHA256 2c466f7bc985e031913991fad6a0e3a7deb12dbacf71a052a6a9e28804d74e0c
  • MD5 fbc8221bf9b6198c6111b981a78956e3
  • SHA1 6a753c53b151261b40468dd235eb5dd5cfd3994a
  • SHA512 c180bfe41e007821ed07a92a35f34401c3d1fbf71b7178ee664b492bc3820547848fbf87072920aa89e89cd8bfd99d971737938cfbd9d54e3af4f58458bb698a
  • SSDEEP 12288:RRsMmWuSCwTCopbzHwGmFeJfB/D3iTmXRplbHAusYa:YnoFw3MzDRLbHAusYa
  • TLSH
    T11B94CF2453A614CAD68C99D4085E1BCAB0ED89C1B9C0D1D5AFBEC7C23F619DBDAF4630
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  discoveryexecutionxwormpersistencerattrojancollectiondefense_evasionspywarestealer

  • Detect Xworm Payload

  • Family: Xworm

    Xworm is a remote access trojan written in C#.

    trojanratxworm

  • Command and Scripting Interpreter: PowerShell

    Run Powershell and hide display window.

    execution

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Accesses Microsoft Outlook profiles

    collection

  • Suspicious use of SetThreadContext

  behavioral1behavioral2