Extracted

• • Target
    9bb59a176690660f28ce12e92d0cdb46.exe
  • Size 1.2MB
  • SHA256 48c07e5d17fec5de4a2fbb9a79de4bb739bf3284ecd7a561eb0d60a711328c43
  • MD5 9bb59a176690660f28ce12e92d0cdb46
  • SHA1 6fa3f29fdb018817dc1113751ea3b09d9add37f8
  • SHA512 88dcbcc06d151469a00dfaf2276e365d1648614334063a2317dd6e70cd76931804dbd3a1eeeff6d724774b8cd8349d84d78fa966d07e16fa0855257742a0551d
  • SSDEEP 24576:EavgUBqnGAdSfIXzWJrXgNpvkvIYzbmLFmjP:Cy4IrwjkVbm0L
  • MD5 SHA1 SHA512 SSDEEP

  Score

  10^/10

  xwormpersistenceratspywarestealertrojan

  • Detect Xworm Payload

  • Xworm

    Xworm is a remote access trojan written in C#.

    trojanratxworm

  • Xworm family

    xworm

  • Drops startup file

  • Executes dropped EXE

  • Modifies system executable filetype association

    persistence

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Adds Run key to start application

    persistence

  • Enumerates connected drives

    Attempts to read the root path of hard drives other than the default C: drive.

  • Legitimate hosting services abused for malware hosting/C2

  behavioral1