Extracted

Extracted

• • Target

    Wave.exe_stage5

  • Size

    77KB

  • MD5

    0967dbc4632642ee26d9d73447b7734e

  • SHA1

    e40de079c23265f8cf23c88724a83efad33eb09a

  • SHA256

    26f1a58af1a708ce295d228e1ce527eb336bdcee5b074d893b9476e5ca4792fd

  • SHA512

    5b4d220499926259e480b90fb0b705d4e876704c98b96002dce745731e5293e693dcaa6453c20b076af041edca90561e5fc9f9e906876129921bb86d684acb00

  • SSDEEP

    1536:0+xnzzJ0BslP/Q6J1gbH7fyHjcM6ORX9EwSbAh/CEN6y6mgOBmGj6n+B:fmslafJOKbAkG8OBmGE+B

  Score

  10^/10

  latentbotxwormexecutionpersistencerattrojan

  • Detect Xworm Payload

  • LatentBot

    Modular trojan written in Delphi which has been in-the-wild since 2013.

    trojanlatentbot

  • Latentbot family

    latentbot

  • Xworm

    Xworm is a remote access trojan written in C#.

    trojanratxworm

  • Xworm family

    xworm

  • Command and Scripting Interpreter: PowerShell

    Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

    execution

  • Drops startup file

  • Executes dropped EXE

  • Adds Run key to start application

    persistence
  behavioral1