Extracted

Extracted

• • Target
    9758f758b221d0ab47e831ce9ec8dee2e8d9fbb58d3c91b0ce056fa1f6fa0cfd.exe
  • Size 463KB
  • SHA256 9758f758b221d0ab47e831ce9ec8dee2e8d9fbb58d3c91b0ce056fa1f6fa0cfd
  • MD5 d6b49ebe62592843ab232a33d1e920f4
  • SHA1 ac1e23b16ba3d959263cbb7b0542fa82eb27cd28
  • SHA512 9c2e1edb68c6025f479711f9d47cf60bdc574d516d82fe9fa95d9e562907d1530f6ff6b274d789627688ba8b178943e520a5fde3f10d6fbe2b69a4d87f4d7a3d
  • SSDEEP 6144:6tf+BLtABPDsthn9pXsBbwopWVo0kjafTiElI1D0REaIHkmbqFM:ZtlwRwopOo00p1DRaIEhFM
  • TLSH
    T104A4C58A1E9446B7D3AEE67490B3333D837BA8397BA7DF4D984A3D9917323488500753
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  discovery44caliberxwormratspywarestealertrojan

  • Detect Xworm Payload

  • Family: 44Caliber

    An open source infostealer written in C#.

    stealer44caliber

  • Family: Xworm

    Xworm is a remote access trojan written in C#.

    trojanratxworm

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Accesses cryptocurrency files/wallets, possible credential harvesting

    spyware

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

    discovery
  behavioral1behavioral2