Extracted

• • Target

    hh.exe

  • Size

    49KB

  • MD5

    0bcfec1c5af3494a04036c491e630b65

  • SHA1

    f93c29ab731b839f700e1cffd022e76781a26117

  • SHA256

    0ed5d00adbb329b4e61a9ecea0c8aa263d4d314cdd1544ce5cf88b24f86dd82a

  • SHA512

    3e5321ae24fb7474af438ae9e1c907f6f8a77a81a9702d9b7ceb39b2e79734c232832458f3582f5bd85ca5ff9e8faee2269646efc34f60dd383c670e37aa649b

  • SSDEEP

    1536:4Tujmz5tnrrwwO2RdbR0Qkbbn2THa5nOaDKk:4TuY5cYdbmQkbb2m5nOaWk

  Score

  10^/10

  xwormpersistencerattrojan

  • Detect Xworm Payload

  • Xworm

    Xworm is a remote access trojan written in C#.

    trojanratxworm

  • Xworm family

    xworm

  • Drops startup file

  • Executes dropped EXE

  • Adds Run key to start application

    persistence

  • Legitimate hosting services abused for malware hosting/C2

  behavioral1