Extracted

• • Target
    13f71181766225fcbc41824a7745da85.exe
  • Size 834KB
  • SHA256 c0ae2ba5faaf690c0970ad7a0a52e832cb086397d150f43063caa160a36ded9d
  • MD5 13f71181766225fcbc41824a7745da85
  • SHA1 b0e11df0aea0310ad8a618098188980dd0562a53
  • SHA512 96f4680f0d9a3b2ed01c7fd7bb03888c42c26bfde69af4c23a530ddbd52fe23771ee21acedbee76fe0b6a6bc0c7a1f70e8c31f32933145cb870a0b81b76614d8
  • SSDEEP 24576:qKqpCZGE96zN4tqEKmJM60PkE16YeGVBhEv748BdEU9RcxPSi7OWBBJfwCVVQNIu:T0on
  • MD5 SHA1 SHA512 SSDEEP

  Score

  10^/10

  xwormpersistenceratspywarestealertrojan

  • Detect Xworm Payload

  • Xworm

    Xworm is a remote access trojan written in C#.

    trojanratxworm

  • Xworm family

    xworm

  • Drops startup file

  • Executes dropped EXE

  • Modifies system executable filetype association

    persistence

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Adds Run key to start application

    persistence

  • Enumerates connected drives

    Attempts to read the root path of hard drives other than the default C: drive.

  • Legitimate hosting services abused for malware hosting/C2

  behavioral1