Extracted

• • Target
    Swift_copy_09_october..bat
  • Size 859KB
  • SHA256 6d9c8a6b19a99c5cbcd3956a4412947509043ce24d1eccb828c14a1b2170a9ad
  • MD5 15eaa2f8b206f8d0d41852e39eaac0ea
  • SHA1 7f61bb755f1b40b299563c440af5ea77156c6201
  • SHA512 809b3c34cc3115b120bfe78575da0aabdf807df6bae582dc0cd3809c879abd61bc4920d816fa5aa04fbc63ce3fb99e1d6fba84787212a3b95cb7f932beb17c31
  • SSDEEP 24576:Y01ZGaI8gkU7pJhTkPC1+Rih5mDlsusvBvhP+4:YSrgki3Vt1+RKPt+
  • TLSH
    T13B151604A546DC0AC4D40272ECD381BFB2715DB3E421E96BE5893E9E3A35792FF46983
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  collectiondefense_evasiondiscoveryexecutionxwormpersistenceprivilege_escalationratspywarestealertrojan

  • Detect Xworm Payload

  • Family: Xworm

    Xworm is a remote access trojan written in C#.

    trojanratxworm

  • Command and Scripting Interpreter: PowerShell

    Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

    execution

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Creates a file in the Startup directory

    A file was written to a Windows startup folder. Files in these directories are executed automatically when a user logs on or an application initializes.

    persistenceprivilege_escalation

  • Reads user/profile data of local email clients

    Email clients store some user data on disk where infostealers will often target it.

    spywarestealer

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Accesses Microsoft Outlook profiles

    collection

  • SmartAssembly .NET packer

    Detects SmartAssembly .NET packer.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2