Extracted

• • Target
    QP RG 5683674 img.MSI
  • Size 340KB
  • SHA256 4689c3da35b61bd84a7d57363c9d346078ec8645ef72d4397cd608f97c62f601
  • MD5 b6d3725c8ebe3fc698b420a246ede5b5
  • SHA1 7a50a0c1e59801c405f4444606135c0c16df3de3
  • SHA512 9455a0f5230769c3ed0f0ade8770676c06b9047b0fe3d5f3115b345e12dfb0653b91fdf52661d1c46aad107bfa0cd709e794aeb765cb1e3cf8684202db279608
  • SSDEEP 6144:UOBG6Ug4yDf0/Bu08rKS932ZH1olrr0D+0xKZdQhOmQqOfds2cR:UO8UHf+DmpodhB/2o
  • TLSH
    T1AF7423443372C637C9620773CBAE8AA88F76BC614B4318166144FB6C2EBA164479BDF5
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  collectiondiscoveryxwormransomwareratspywarestealertrojan

  • Detect Xworm Payload

  • Family: Xworm

    Xworm is a remote access trojan written in C#.

    trojanratxworm

  • Executes dropped EXE

  • Reads user/profile data of local email clients

    Email clients store some user data on disk where infostealers will often target it.

    spywarestealer

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Accesses Microsoft Outlook profiles

    collection

  • Enumerates connected drives

    Attempts to read the root path of hard drives other than the default C: drive.

  • Suspicious use of NtSetInformationThreadHideFromDebugger

  behavioral1behavioral2