Extracted

Extracted

• • Target

    MasonClient.exe

  • Size

    51KB

  • MD5

    98b0077862a1b5e9cfb7257a96abfbf2

  • SHA1

    c608b9257f5eb5c547875a38b27567ff1fd3fe44

  • SHA256

    0f4691e7c8b5f9bbd913c207f7d57f3b514e6adee47b32d57ebe0665632a8aac

  • SHA512

    0f80ea3b6e04af7dc96f085b318a0b8736dfc72a7d8ac73d86a31023f895be9c3e4cbbef00da507494c3e19a7c376661ed0b91cbf11aef5e1590e3b6c271a846

  • SSDEEP

    1536:IUIPbL8Z6az90D7h47T7baurM+/MbOTuL:IUIPHA6az903y7fbae/MbOiL

  Score

  10^/10

  xwormexecutionrattrojandiscovery

  • Detect Xworm Payload

  • Xworm

    Xworm is a remote access trojan written in C#.

    trojanratxworm

  • Xworm family

    xworm

  • Command and Scripting Interpreter: PowerShell

    Run Powershell and hide display window.

    execution

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Legitimate hosting services abused for malware hosting/C2

  behavioral1behavioral2