Extracted

• • Target

    Rc7fork.exe

  • Size

    155KB

  • MD5

    89cdea23fcf69912e06646f51cfdc2a5

  • SHA1

    a3236b8ef58ea89cd98c01d0e3f1ac4bc350c5bb

  • SHA256

    a3ec5b6f6fa4b9aa52045c78d2796ece4824284c356b32d3214ce8a1226c9267

  • SHA512

    1bc40fc961fbe4909ab2eff3165529228d39e8c9f89699509bf2b5b60380daf8361103bd7967a8bb9843178e05ba6ee68a3a82adf5520e2cb9403125230b94f9

  • SSDEEP

    3072:/uoFqLtXnpZ9v87jzEfo4rswbj/yjgf6yFOBvqsfzOIFc:1FspT87jz7D6qm6ysBvqsrj

  Score

  10^/10

  xwormpersistencerattrojan

  • Detect Xworm Payload

  • Xworm

    Xworm is a remote access trojan written in C#.

    trojanratxworm

  • Xworm family

    xworm

  • Executes dropped EXE

  • Adds Run key to start application

    persistence

  • Legitimate hosting services abused for malware hosting/C2

  behavioral1