Extracted

• • Target
    XWorm V3.0.exe
  • Size 18.1MB
  • SHA256 1ecaef02589541155ee044c0981b45e325d3fe0d8aecda47ee6d21625406b492
  • MD5 3faec82081e744d5a3f2a8bd97d17108
  • SHA1 5f781f97bc4844a7ee1beccea2fa10172c7cf080
  • SHA512 a59f9e933c635df5adf5c86fd2c3c69a390a7a851074d66d0d2542a6b89319e7c79a2d131fe3b717931606a6686eadc477296bfc561370caace8d3b7afce9a88
  • SSDEEP 393216:mz3vWDvhEjixHz13w/7quT/XBW/byiBhdeaYJAxtVDqBF3JTdRH+7n:mz3vWtEjixHReBW/bX/PqB1JTf+
  • TLSH
    T1A01723B09A22E2C9E464073FDE15E6FF5FE60DB7924A479D2DE1BE733821496059080F
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  collectiondefense_evasiondiscoveryexecutionxwormpersistenceprivilege_escalationratspywarestealertrojanupxadwareransomware

  • Deletes Windows Defender Definitions

    Uses mpcmdrun utility to delete all AV definitions.

    defense_evasion

  • Detect Xworm Payload

  • Family: Xworm

    Xworm is a remote access trojan written in C#.

    trojanratxworm

  • Boot or Logon Autostart Execution: Active Setup

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

    persistence

  • Command and Scripting Interpreter: PowerShell

    Using powershell.exe command.

    execution

  • Disables one or more Microsoft Defender components

    Uses the Powershell Set-MpPreference cmdlet to disable one or more Microsoft Defender components.

    defense_evasion

  • .NET Reactor proctector

    Detects an executable protected by an unregistered version of Eziriz's .NET Reactor.

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Clipboard Data

    Adversaries may collect data stored in the clipboard from users copying information within or between applications.

    collection

  • Executes dropped EXE

  • Loads dropped DLL

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Enumerates connected drives

    Attempts to read the root path of hard drives other than the default C: drive.

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

    discovery

  • Discovers running processes

    Running process information can be used to identify security tools or plan follow-on actions.

    discovery

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  behavioral1behavioral2behavioral3behavioral4