Extracted

• • Target
    XWormClient.exe
  • Size 32KB
  • SHA256 cf14244fb788ca119fbc290c434897e7e928cd8b7bec19e501b92f8cabde38ae
  • MD5 cbc28d047ec88a5170010676d6d275db
  • SHA1 3361e48376b4ada8310a7ccded47e7f2a776bf37
  • SHA512 53545d8aada0c72097e6316e9a87b17f66ded2657489149dbb33cbe85723262d2bd2e2b22d73c2d0eb191fb7b40537affe3e88faa65dce2df4a02c7db229c4a4
  • SSDEEP 384:oYaJWq4Ava7Rm32oDuuw3+q5XwYeLBEwvh0FbOKTCOQS+RApkFTBLTAOZwpGd2v9:gxC3fOJ5ywvGFbO75S+VFo9jrOjhZbO
  • TLSH
    T16CE24C4877E44312D9FEAFF02DF2710A1675E11B9823EF5E0CD4C99A2B63AC146507EA
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  adwarebootkitcollectionexecutionxwormpersistenceprivilege_escalationratspywaretrojan

  • Detect Xworm Payload

  • Family: Xworm

    Xworm is a remote access trojan written in C#.

    trojanratxworm

  • Boot or Logon Autostart Execution: Active Setup

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

    persistence

  • Manipulates Digital Signatures

    Attackers can apply techniques such as changing the registry keys of authenticode & Cryptography to make their binary seem validly signed.

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Event Triggered Execution: Component Object Model Hijacking

    Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.

    persistenceprivilege_escalation

  • Executes dropped EXE

  • Modifies system executable filetype association

    persistence

  • Accesses Microsoft Outlook profiles

    collection

  • Adds Run key to start application

    persistence

  • Writes to the Master Boot Record (MBR)

    Bootkits write to the MBR to gain persistence at a level below the operating system.

    bootkitpersistence

  • Drops file in System32 directory

  behavioral1behavioral10behavioral11behavioral12behavioral13behavioral14behavioral15behavioral16behavioral17behavioral18behavioral19behavioral2behavioral20behavioral3behavioral4behavioral5behavioral6behavioral7behavioral8behavioral9