Extracted

• • Target
    svchost.exe
  • Size 254KB
  • SHA256 279811a1913a83c9d000835c161523cfcb0001489c0f21d62e69c08074bfe3af
  • MD5 3cdd17eac36f13f2ddcceb027dbcb86c
  • SHA1 d1dd015b243098f28ce38717549841faea8dec73
  • SHA512 fab7711f46a3581d81a6d9bca61e5722158af065d92c067d6a0d25d2812baffcaaebb9d10fe55c2ac5bb5c315cc986133f306bea6ebcd37f84042920a5163666
  • SSDEEP 6144:Kc08m+Rm8FAbxoQAEipx6D2WL/rKYITHK:/08m+dFAbxv2WLfT
  • TLSH
    T1C9444B6433FC0A00F3BF8B34A9B4555446B6F92AE916D74D1D9238DD6E32B91AD20B33
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  collectiondefense_evasiondiscoveryxorium_stealerpersistenceprivilege_escalationspywarestealer

  • Family: XoriumStealer

    XoriumStealer is an information stealer written in C#.

    stealerxorium_stealer

  • Executes a file named after a Windows system binary

    The file runs from a user directory while carrying the name of an executable that normally only exists in System32.

    defense_evasion

  • Reads WinSCP keys stored on the system

    Tries to access WinSCP stored sessions.

    spywarestealer

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Accesses Microsoft Outlook profiles

    collection

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery

  • Enumerates connected drives

    Attempts to read the root path of hard drives other than the default C: drive.

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

    discovery
  behavioral1