Extracted

• • Target

    ExodusWallet.zip

  • Size

    54.1MB

  • MD5

    0cf76bda289fe2a0f47dd6ae4d8e5c92

  • SHA1

    7ec6f979cd7920d2017a658f0d86ba49c4f8c2e7

  • SHA256

    8307d06013e9072761237a4432ef62e3cb02ad28e16eae71d9e4191c002dcb44

  • SHA512

    1704d48b027da2a20f599b368000a37272e7ba15b9f051fd1ab9c26ec57da8c84f20dabd118aab8cfeb4b81a8e193890cb9ac845af5dda67d418494919c875fc

  • SSDEEP

    1572864:QNV4NFAUmDbtJ3zM/zO8wyQso0jWzan/coE5:g5UKAq8nQJTa/coE5

  Score

  10^/10

  xwormdiscoveryexecutionrattrojan

  • Detect Xworm Payload

  • Xworm

    Xworm is a remote access trojan written in C#.

    trojanratxworm

  • Xworm family

    xworm

  • Blocklisted process makes network request

  • Command and Scripting Interpreter: PowerShell

    Powershell Invoke Web Request.

    execution

  • Drops startup file

  • Executes dropped EXE

  • Legitimate hosting services abused for malware hosting/C2

  behavioral1behavioral2behavioral3