General
- Target 536eee6786982ee1413cfb3596841979193ae0bc13815217f9df25f40978e355
- Size 540KB
- Sample261102-nmpgmasyfs
- SHA256 536eee6786982ee1413cfb3596841979193ae0bc13815217f9df25f40978e355
Score
10/10
Malware Config
Targets
-
- Target CORRECT FOB VALUE.exe
- Size 657KB
- SHA256 467930e420c4cee4eb5b34d212ed17296f3f16c0b8fdcd794ca6efef23032a26
Score10/10-
Detect Xworm Payload
-
Family: Xworm
Xworm is a remote access trojan written in C#.
-
Modifies Windows Defender DisableAntiSpyware settings
-
Command and Scripting Interpreter: PowerShell
Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Reads user/profile data of local email clients
Email clients store some user data on disk where infostealers will often target it.
-
Reads user/profile data of web browsers
Infostealers often target stored browser data, which can include saved credentials etc.
-
Accesses Microsoft Outlook profiles
-
Suspicious use of SetThreadContext
MITRE ATT&CK Enterprise v16
Credential Access
Credentials from Password Stores
1Credentials from Web Browsers
1Unsecured Credentials
2Credentials In Files
2