Extracted

Extracted

• • Target
    8f57da1ea700d5abeedb5c9a4448ec203dff39321f01e99a0544fa5130da4525
  • Size 525KB
  • SHA256 8f57da1ea700d5abeedb5c9a4448ec203dff39321f01e99a0544fa5130da4525
  • MD5 5bf9488d3f61785a4f0a521841a8254e
  • SHA1 aff60dd38f0f3cdeb99fc3ca261d3afc58c200c4
  • SHA512 4680b8143bcac57c6730d96151e8a3a8760c1da32dcb6c67f4d0e0389f301402e0e6fa0240c78b55b9b92db8faee457ecdb8fee8a49798911f2ee05ebba9ac88
  • SSDEEP 12288:VcF3UU0AViEhkwkhoo+/TUszmXxr1svZ92xt:x1AViE/kHszmXWZM
  • TLSH
    T1FAB4AE01BAF1C1B2D57664700939EB35DEBCBC210C359D2B63D61E9ABE301519B3AB72
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  collectiondiscoveryxwormpersistenceprivilege_escalationratspywarestealertrojan

  • Detect Xworm Payload

  • Family: Xworm

    Xworm is a remote access trojan written in C#.

    trojanratxworm

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Creates a file in the Startup directory

    A file was written to a Windows startup folder. Files in these directories are executed automatically when a user logs on or an application initializes.

    persistenceprivilege_escalation

  • Executes dropped EXE

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Accesses Microsoft Outlook profiles

    collection

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery

  • Suspicious use of SetThreadContext

  behavioral1behavioral2