Extracted

• • Target
    Client.exe
  • Size 247KB
  • SHA256 7c826af402d87a5ef6c8307c5beb938c28403f19aa8ef118a01669bce82753ea
  • MD5 a41b2479c80ee03946ca7ca187ab84bf
  • SHA1 81b90d574607531361e153e75bef4f50749cb629
  • SHA512 6f40ebab7fca837e2bc9de84906c7414cc46c34d76fcad92c4fb328cbef4ce4e17ddfd53abb9e8c1c7a9111f361abc7b31daf4457b36b2f1fd9a04f8e790faa7
  • SSDEEP 3072:imDTxU7ZsUFLX1OSBsZ1npBb8GmOaMeaY2QHs5DbJISFirKoXsl+fKpt:iffcKG1np2F1YF+rKobyp
  • TLSH
    T14844288477FC1614F2BF8F39A87454504AB7F467A936D70E0C96A0DC6A32B90EA54B33
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  collectiondiscoveryxorium_stealerxwormpersistenceprivilege_escalationratspywarestealertrojan

  • Contains code to disable Windows Defender

    A .NET executable tasked with disabling Windows Defender capabilities such as realtime monitoring, blocking at first seen, etc.

  • Detect Xworm Payload

  • Detects XoriumStealer payload

  • Family: XoriumStealer

    XoriumStealer is an information stealer written in C#.

    stealerxorium_stealer

  • Family: Xworm

    Xworm is a remote access trojan written in C#.

    trojanratxworm

  • Downloads MZ/PE file

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Reads WinSCP keys stored on the system

    Tries to access WinSCP stored sessions.

    spywarestealer

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Accesses Microsoft Outlook profiles

    collection

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery

  • Contacts third-party web service commonly abused for C2

    Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

    discovery
  behavioral1behavioral2