General
- Target NewLauncher-2.0.9-windows-x64.exe
- Size 101.3MB
- Sample260913-sqdlraydrd
- SHA256 972bda38422c28c0473e91c83c47285c7a81811c92625efb9cbe7f2b4d287860
Malware Config
Targets
-
- Target NewLauncher-2.0.9-windows-x64.exe
- Size 101.3MB
- SHA256 972bda38422c28c0473e91c83c47285c7a81811c92625efb9cbe7f2b4d287860
Score10/10-
Contains code to disable Windows Defender
A .NET executable tasked with disabling Windows Defender capabilities such as realtime monitoring, blocking at first seen, etc.
-
Detect Xworm Payload
-
Family: Xworm
Xworm is a remote access trojan written in C#.
-
UAC bypass
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Executes dropped EXE
-
Loads dropped DLL
-
Reads ssh keys stored on the system
Tries to access SSH used by SSH programs.
-
Checks installed software on the system
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Contacts third-party web service commonly abused for C2
Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.
-
Looks up external IP address via web service
Uses a legitimate IP lookup service to find the infected system's external IP.
-
Command and Scripting Interpreter: PowerShell
Using powershell.exe command.
MITRE ATT&CK Enterprise v16
Privilege Escalation
Abuse Elevation Control Mechanism
1Bypass User Account Control
1Defense Evasion
Abuse Elevation Control Mechanism
1Bypass User Account Control
1Hide Artifacts
1Ignore Process Interrupts
1Impair Defenses
1Disable or Modify Tools
1Modify Registry
2