Extracted

• • Target

    sample

  • Size

    3KB

  • MD5

    8f42ccb443b9a6b53c6dc09a7eb26775

  • SHA1

    2349df6e48fcba4e6b8994403d01f3f02899e200

  • SHA256

    3f5996cd1014590af1a91a9b3c711cdefaabcb93e8b7399ebb801cc7f7cee762

  • SHA512

    2621d678cf76c61e1c800e3b03706423840d6a93f22b7945364a43c441b43fe3a2ab34a040102fa36c082bc7730395fdef2dc5db2ebae5efa844ffa89ebe77fa

  Score

  10^/10

  xwormdiscoverydropperpersistenceprivilege_escalationrattrojan

  • Detect Xworm Payload

  • Xworm

    Xworm is a remote access trojan written in C#.

    trojanratxworm

  • Xworm family

    xworm

  • Download via BitsAdmin

    dropper

  • Downloads MZ/PE file

  • Event Triggered Execution: Component Object Model Hijacking

    Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.

    persistenceprivilege_escalation

  • Executes dropped EXE

  • Loads dropped DLL

  • Uses the VBS compiler for execution

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery

  • Legitimate hosting services abused for malware hosting/C2

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Drops file in System32 directory

  behavioral1