Extracted

• • Target
    XClientt.exe
  • Size 32KB
  • SHA256 649a1a2deba1ddd23cf5fb17c4c2521d0e14c610ce2243854b249f486dd9547c
  • MD5 5d327ee0273e1a47b58137637afb3f36
  • SHA1 11c285b857c98e1cb8bb274c39c92579e2bd1afe
  • SHA512 5de226e05e53ea58e678b89870caeab4a471df66623d9816891b4c9458bb8238bb0212b9243ee17cd8d7676a9fc13dcf59271e4152b12acf53b3214be28e97be
  • SSDEEP 384:6EbmX5Qa+vN1h1+X3v6JFjL+gkr3Tm2eaFO8pzRApkFTBLTsOZwpGd2v99IkuisS:zVa+vNtg+PB83Tw4ppzVFE9jzOjh8bT
  • TLSH
    T1DDE23B4877D44712DAEEAFB12DF362061270D51BE813EF5E0CE485EA2B67AC047417EA
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  adwarebootkitcollectiondefense_evasiondiscoveryexecutionxwormpersistenceprivilege_escalationratspywarestealertrojan

  • Detect Xworm Payload

  • Family: Xworm

    Xworm is a remote access trojan written in C#.

    trojanratxworm

  • Boot or Logon Autostart Execution: Active Setup

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

    persistence

  • Manipulates Digital Signatures

    Attackers can apply techniques such as changing the registry keys of authenticode & Cryptography to make their binary seem validly signed.

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Event Triggered Execution: Component Object Model Hijacking

    Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.

    persistenceprivilege_escalation

  • Executes dropped EXE

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Accesses Microsoft Outlook profiles

    collection

  • Adds Run key to start application

    persistence

  • Writes to the Master Boot Record (MBR)

    Bootkits write to the MBR to gain persistence at a level below the operating system.

    bootkitpersistence

  • Drops file in System32 directory

  behavioral1behavioral2