Extracted

• • Target

    main.exe

  • Size

    7.3MB

  • MD5

    17741d73622b968fb2994a7ecab90b21

  • SHA1

    bf1676bd064c4b9a1151348bc4310c15f506d205

  • SHA256

    9dc579518e8d00546ce132209aee6f5c8eb78b22ed5828f316cdf0f81c720521

  • SHA512

    3a5833a9c687f79428707e1be15fcda5d7aacd21b05e765235efa13f6424d30d501f5bd85d6dc1b62bcab947dae7069334ed8fba39365b1fa217ad7daec62f06

  • SSDEEP

    196608:/snm8b83kdaXMCHGLLc54i1wN+DrRRu7NtbFRKnZMvDrGmh1wlxN8:G5/cXMCHWUj7rRQ7XbFsn6vH5WN

  Score

  10^/10

  xwormpersistencerattrojan

  • Detect Xworm Payload

  • Xworm

    Xworm is a remote access trojan written in C#.

    trojanratxworm

  • Xworm family

    xworm

  • Boot or Logon Autostart Execution: Active Setup

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

    persistence

  • Executes dropped EXE

  • Loads dropped DLL

  • Enumerates connected drives

    Attempts to read the root path of hard drives other than the default C: drive.

  behavioral1behavioral2