Extracted

• • Target
    Rainbow Dash Client.exe
  • Size 30KB
  • SHA256 54ec3a22002b572e1f680616e496aa4f2b9b2907cb145e0b9fe6b66b32e3621e
  • MD5 982d3c46cd800652c05317030b882467
  • SHA1 2f372a75237bfc61f724cec4bd6bb68a42dfac62
  • SHA512 fdb42956442a8784411067c52d21b6bd5571b6d76bcd3fb57bde2e5cbcc60d93542cd432ee4ae34a12bc0da8fcb969c7f09f2f4e593f7295609c5d58cca6c4a8
  • SSDEEP 768:nXpzJiHzHvMYAoRFNM2uBFE9RqOqhEbS:XpzslNM24FE9RqOqyG
  • TLSH
    T154E24B483BE58327D6FE2FF229B6900202759507D923EF5F4CD885AB6F67B8042013E6
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  adwarebootkitcollectiondiscoveryexecutionxwormpersistenceprivilege_escalationratspywaretrojandefense_evasion

  • Detect Xworm Payload

  • Family: Xworm

    Xworm is a remote access trojan written in C#.

    trojanratxworm

  • Boot or Logon Autostart Execution: Active Setup

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

    persistence

  • Manipulates Digital Signatures

    Attackers can apply techniques such as changing the registry keys of authenticode & Cryptography to make their binary seem validly signed.

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Event Triggered Execution: Component Object Model Hijacking

    Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.

    persistenceprivilege_escalation

  • Executes dropped EXE

  • Modifies system executable filetype association

    persistence

  • Accesses Microsoft Outlook profiles

    collection

  • Adds Run key to start application

    persistence

  • Writes to the Master Boot Record (MBR)

    Bootkits write to the MBR to gain persistence at a level below the operating system.

    bootkitpersistence

  • Drops file in System32 directory

  behavioral1behavioral2