Extracted

• • Target

    B4VVtERhIuUi.reg

  • Size

    67KB

  • MD5

    f0e94218233968b75d2ddb2040dc6617

  • SHA1

    4f0e5778a92de896a753d924085e163130fb5584

  • SHA256

    8f0700c47b590a8072cc4e12e3016788b678ffffbddb87883646697b39337074

  • SHA512

    da863d750ae25545d6ff7f2dfbc78cc971d6332f14571da47cf88ab7a36ce60ce52f7c786420e322ffbd006d96b400339f3b9a6e0aa7c49c6f84855bd6180b0b

  • SSDEEP

    1536:D4g540DoR+MQRxYvgUV/AV18G84p1V2ktjiEmpKXS4D18WsPHDqRO:DXmE0vPmMjkwpKpjsPHDqRO

  Score

  10^/10

  persistencexwormdefense_evasionexecutionrattrojan

  • Detect Xworm Payload

  • Xworm

    Xworm is a remote access trojan written in C#.

    trojanratxworm

  • Xworm family

    xworm

  • Blocklisted process makes network request

  • Command and Scripting Interpreter: PowerShell

    Run Powershell and hide display window.

    execution

  • System Binary Proxy Execution: Regsvcs/Regasm

    Abuse Regasm to proxy execution of malicious code.

    defense_evasion

  • Executes dropped EXE

  • Adds Run key to start application

    persistence

  • Legitimate hosting services abused for malware hosting/C2

  • Drops file in System32 directory

  behavioral1behavioral2