Extracted

• • Target
    XBinderOutput.exe
  • Size 90KB
  • SHA256 5c9efa6ab81a830ec0bfd565cb268e1c5848989e5a2e6ee88859a523f32886f9
  • MD5 5269bb0c9e752c18dd751603711cc764
  • SHA1 b0c9920e7e17e33727e8bcc83f5318d1a944328d
  • SHA512 075c8c034794db39bbd26c3ed1aa5f2b6009fd2759df43b6868ae01c6f387e209ce0f8d920ec3231e507742d25c115b1f4fae9cf51ce51e795b0f84114a84014
  • SSDEEP 1536:JZMxgdXbmzjsaNWq0W1gUYil506s9Z39p4g:jJmHsCWq0W1gH7V9R4g
  • TLSH
    T1D793AE4227A9456EC4E949325A22C2B50374EE122D026F6FEED0BF5F3D772978D421F0
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defense_evasiondiscoveryevasionexecutionexploitxbinderimpactloaderpersistenceransomwarespywarestealer

  • Family: XBinder

    XBinder is a crypter and loader delivering a wide variety of malware, written in C#.

    loaderxbinder

  • Modifies WinLogon for persistence

    persistence

  • Deletes shadow copies

    Ransomware often targets backup files to inhibit system recovery.

    ransomwaredefense_evasionimpactexecution

  • Modifies boot configuration data using bcdedit

    ransomwareevasion

  • Boot or Logon Autostart Execution: Active Setup

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

    persistence

  • Command and Scripting Interpreter: PowerShell

    Using powershell.exe command.

    execution

  • Deletes backup catalog

    Uses wbadmin.exe to inhibit system recovery.

    ransomware

  • Disables RegEdit via registry modification

    defense_evasion

  • Disables Task Manager via registry modification

    defense_evasion

  • Disables use of System Restore points

    defense_evasion

  • Drops file in Drivers directory

  • Possible privilege escalation attempt

    exploit

  • Sets file to hidden

    Modifies file attributes to stop it showing in Explorer etc.

    defense_evasion

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Creates new service(s)

    persistenceexecution

  • Executes dropped EXE

  • Impair Defenses: Safe Mode Boot

    defense_evasion

  • Modifies file permissions

    discovery

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Stops running service(s)

    defense_evasionexecution

  • Adds Run key to start application

    persistence

  • Enumerates connected drives

    Attempts to read the root path of hard drives other than the default C: drive.

  • File and Directory Permissions Modification: Windows File and Directory Permissions Modification

    defense_evasion

  • Maps connected drives based on registry

    Disk information is often read in order to detect sandboxing environments.

  • Drops file in System32 directory

  behavioral1behavioral2