Extracted

• • Target
    PaymentCopy.exe
  • Size 808KB
  • SHA256 4aa83d28a94a44ba74abbb347fb7601805cd94a6270810af4abf472e8b6c4986
  • MD5 e08d42b7a40fab007fc2b4fff8eb7034
  • SHA1 c7c9c4b09ff4438e35fa48fc4fd14e1b72a15b82
  • SHA512 7547ee490973ca966a121dd920a261b8b7fc09a8da210fc24177b1dea2297a776d323f326f8654f543aa7cf482ed23a14ae5857ed46e2d516fe15ebbe5f27424
  • SSDEEP 12288:G1nX5xlRlg5FPaYC5g1DtTNecBMovgikTXFP6ogO85:G1VngLaFgrNePovFh
  • TLSH
    T1F005DF2427B6CE1EC49503F31EE2E2B157799D69922CC302BEF57CD77836A8518583E2
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defense_evasiondiscoveryevasionexecutionxwormpersistenceprivilege_escalationratspywarestealertrojancollection

  • Detect Xworm Payload

  • Family: Xworm

    Xworm is a remote access trojan written in C#.

    trojanratxworm

  • Modifies Windows Defender DisableAntiSpyware settings

    evasiontrojan

  • Creates a file in the Startup directory

    A file was written to a Windows startup folder. Files in these directories are executed automatically when a user logs on or an application initializes.

    persistenceprivilege_escalation

  • Executes dropped EXE

  • Loads dropped DLL

  • Reads user/profile data of local email clients

    Email clients store some user data on disk where infostealers will often target it.

    spywarestealer

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Accesses Microsoft Outlook profiles

    collection

  • Enumerates connected drives

    Attempts to read the root path of hard drives other than the default C: drive.

  • SmartAssembly .NET packer

    Detects SmartAssembly .NET packer.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2