Extracted

• • Target
    WAX CLIENT V2.3.1.exe
  • Size 44.5MB
  • SHA256 5d6456dbdc10c247e43eeb4911055b4ad2c397cfc172d96deca0e6e5052fb9e1
  • MD5 17fb9ac9478fbee4d50ab7a8da87b7ff
  • SHA1 f7dc4d873fb39830269dad2e3804e679d4ace34f
  • SHA512 03a33c8f7114eaf5bfc880a88a929c760e3c3dbefd5b993f2cb705926cc428f01793febf3e540b22433a8ea3db7eca4f2a43bcb915556c16c6da74aaf83ff426
  • SSDEEP 786432:6wRGjP20/QXl9rraxREKnVZpxphjGW6nNCVKtle2+M/xVX3ZHlBZb7Rph410MYcb:6gGjP20/QXzuTEKn7phjGWeCVK5NxnHS
  • TLSH
    T1EDA733F6E19F2C61D84B87FAC7194F08B2F2247BA5B1B55577047294B1633823E3A863
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  discoveryexecutionxwormpersistencerattrojan

  • Detect Xworm Payload

  • Family: Xworm

    Xworm is a remote access trojan written in C#.

    trojanratxworm

  • Command and Scripting Interpreter: PowerShell

    Run Powershell and hide display window.

    execution

  • Executes dropped EXE

  • Loads dropped DLL

  • Adds Run key to start application

    persistence

  • Enumerates connected drives

    Attempts to read the root path of hard drives other than the default C: drive.

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

    discovery
  behavioral1behavioral2
• • Target
    stealth_loader.pyc
  • Size 40.5MB
  • SHA256 4a52c315db43959b8d9e2e8f2ba1c30e8cae0dc6c78e16ca520357d5486117d6
  • MD5 653aadbcdaff3fc6eaee6a85f0058f00
  • SHA1 37ed0ebac752ba2f45e434dfb869922d52d4ffae
  • SHA512 1434ab66726a6d01457a7bf17bf511b7f68b87daa5b5ee198f67583f250790890938692cead82379900b58e5864671fcffa80bb6074f34027a86b7721d2591e3
  • SSDEEP 786432:+ss+zSop8edSd+lxebwDmy4pcWjJIacgl2Ivnv:u+mop83+H1my4lNtcEfn
  • TLSH
    T1469712FCA5D11FBC7AA2345237C704142F6A11791BB1227E8117C62733A3E199A7F4EA
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  3^/10

  executionpersistence
  behavioral3behavioral4