xworm | ad6d35ff371547d7f87a6e54244f7d39843ba4924c3370c2b7945efc9cd79501

General

Target
20102026_1308_20102026_Specification_Order_details-Oct-19th_Pdf.zip
Size 503KB
Sample261020-qdc4cabf92
SHA256 ad6d35ff371547d7f87a6e54244f7d39843ba4924c3370c2b7945efc9cd79501
MD5 dd8b003e5d12f4051608b9f927fe1ad2
SHA1 cf658813c8f68a4368b63ef1f2867580580a704f
SHA512 c17bdea1b1172c82a896335e008e4344c92e939bfa65ed7a416a1f4b83acd13a34653e5aacb74827850159493c441fc8131308ad1043f101a98ffddcdb4983c8
SSDEEP 12288:+ISxvox/AjaZ22yyM5s5X2HFWwJ2cbB0kDKHqR2awSrx:///AjopnuvHUYBtDSjFm
TLSH
T112B42315778FC103BC89A0A2585B631C62883BECDE6175B0B7C0A735D8FE5DE8B1625E
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Targets

- Target
  Specification_Order_details-Oct-19th_Pdf.bat
- Size 610KB
- SHA256 17fb280cc5ad5829eed30b6ef0438b08b42768bf1a44330bf75bc307c2fb1073
- MD5 316a598b0d0f500bc69b39d3656b18ee
- SHA1 ec4e9d91c8b664d2224da41f33f43c19f5d4c0ed
- SHA512 dc1006f92805f90a01899105a898cecdfa7dedc0ed32a27c5286fbc2f4a7260841af3bc0dfb14b2159da4a08242e9e801cd88bc958d2826f21c7768479203dfd
- SSDEEP 12288:CR4+5uaVNhwFv/4P+VcThtgSMBGjo0bvdVZvaYvw+Zs:OVYFIPkc3U0bvHMYI
- TLSH
  T180D4CE102265E711D5F277B5C9B1F2F453B8AEC9F821D20B4EE67DDBF831B005A0A692
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

collection defense_evasion discovery execution xworm persistence privilege_escalation rat spyware stealer trojan
- Detect Xworm Payload
- Family: Xworm
  Xworm is a remote access trojan written in C#.
  trojan rat xworm
- Command and Scripting Interpreter: PowerShell
  Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
  execution
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Creates a file in the Startup directory
  A file was written to a Windows startup folder. Files in these directories are executed automatically when a user logs on or an application initializes.
  persistence privilege_escalation
- Executes dropped EXE
- Reads user/profile data of local email clients
  Email clients store some user data on disk where infostealers will often target it.
  spyware stealer
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Accesses Microsoft Outlook profiles
  collection
- Adds Run key to start application
  persistence
- Looks up external IP address via web service
  Uses a legitimate IP lookup service to find the infected system's external IP.
  discovery
- SmartAssembly .NET packer
  Detects SmartAssembly .NET packer.
- Suspicious use of SetThreadContext
behavioral1 behavioral2