Extracted

• • Target
    7024c376d00fbb19ea15f7e06d19d16de65c5b02283e072ae6c16f30dcebb3db.bin
  • Size 3.0MB
  • SHA256 7024c376d00fbb19ea15f7e06d19d16de65c5b02283e072ae6c16f30dcebb3db
  • MD5 23eed88647016a3e5a1a4203ce1ea038
  • SHA1 4b34d42fe513d7729f523ce588caf24907fca854
  • SHA512 e3e3d9284b6847490e8347f5f127c7bbccb1c45c4e4540b5c9eacc2a6f33ada13bd7278afe07c8cfa1a53fdaed502e645c94af347607e6d11fde47a7e645cfea
  • SSDEEP 49152:4wktZq3uo0AWVy+mN69EAY8yxACQ0h6lIsheQohkIs/9ey:itZq3uo0AWVy+mN69EAY8CQ0h88Ds1/
  • TLSH
    T1EDE51C42C53474203D6D5FACC9BB55906F29DA0352849A3E39FCDA5C6BE3782B3DC4A2
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defense_evasiondiscoveryexecutionxwormpyinstallerratspywarestealertrojanupxcollection

  • Detect Xworm Payload

  • Family: Xworm

    Xworm is a remote access trojan written in C#.

    trojanratxworm

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Reads user/profile data of local email clients

    Email clients store some user data on disk where infostealers will often target it.

    spywarestealer

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Accesses Microsoft Outlook profiles

    collection

  • Suspicious use of NtSetInformationThreadHideFromDebugger

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  behavioral1behavioral2