Extracted

• • Target
    Requested Payment Copy.bat
  • Size 1.1MB
  • SHA256 3af985844589030f27a37f164a34e3ba82b2c16833c24cc9e6200b14c07bc8de
  • MD5 ca72172d0c4c509cf6be21871b7f0987
  • SHA1 eeebeff182c7f0dc27dbe7450d07c93283bba86d
  • SHA512 0dce51da26ce9e94987d348cf39ccf397c567f8e44bd3c1310dcb1c5840803a9f8d9c990591e495ac0d61c7c13b7048f59e8b58bdaef18f10a37709bbf1ff244
  • SSDEEP 24576:txlIO2CWbQrOz7+262rr7kBGk09AZjmRSxD3U3wuMA1b8o:tR2CWEe76vGkTmL3kU
  • TLSH
    T14935BEAC32C4E49EC8478FF1C960DD749E112EAA92E7D203D5B73C9BB92D6865D041E3
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  discoveryexecutionxwormpersistenceratspywarestealertrojan

  • Detect Xworm Payload

  • Family: Xworm

    Xworm is a remote access trojan written in C#.

    trojanratxworm

  • Command and Scripting Interpreter: PowerShell

    Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

    execution

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Adds Run key to start application

    persistence

  • SmartAssembly .NET packer

    Detects SmartAssembly .NET packer.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2