Extracted

• • Target

    7ba2a1c494347fc81d2b5785c23b4fc1d0f7975bbab909316caf883c04e7729eN

  • Size

    2.6MB

  • MD5

    a484585e14cd5969b39115a028b8ea30

  • SHA1

    f546ebec7aa938de617458c43d8c4c41c07b080f

  • SHA256

    7ba2a1c494347fc81d2b5785c23b4fc1d0f7975bbab909316caf883c04e7729e

  • SHA512

    9d2041826c57bed82763cdb7691750a6be99f5bf9185e6a393556a879f740f6f9c3b0c6a1541df0699820942bea24064a265fe184ce6650cd0f2333a53a8ca59

  • SSDEEP

    24576:t98MhLDZfqHV4pE+kdfOfulNneCRxZjSP9NW32up92mpxviIGLnyMbOyvlya:t9jhLDtq1yGfOYfxtW9Il7GLFHv

  Score

  10^/10

  xwormpersistencerattrojan

  • Detect Xworm Payload

  • Xworm

    Xworm is a remote access trojan written in C#.

    trojanratxworm

  • Xworm family

    xworm

  • Drops startup file

  • Executes dropped EXE

  • Adds Run key to start application

    persistence

  • Legitimate hosting services abused for malware hosting/C2

  behavioral1behavioral2