Extracted

Extracted

• • Target
    iskkk.exe
  • Size 30KB
  • SHA256 ae7b8b2fb6ec3d1bec5197ab5394a2d5b2a04d991b070295c203aba675beb993
  • MD5 7deafecbe311a3fb41b07421b172186d
  • SHA1 4255720d084cfdbd189691c9422453a099093ade
  • SHA512 7305514828ff098fb887713549fdb0effaf4e267b8d0b8cdeeac4c09f71292741d369295278876855465544acf9898874cce098b145374dcd2d31e740731acee
  • SSDEEP 768:Eecbl/b3yMYAoR/iw2uBFE9RBMOqhhbeQ:rcxaiw24FE9R2Oqn1
  • MD5 SHA1 SHA512 SSDEEP

  Score

  10^/10

  bankerdefense_evasiondiscoverygozixwormisfbpersistenceprivilege_escalationrattrojan

  • Detect Xworm Payload

  • Gozi

    Gozi is a well-known and widely distributed banking trojan.

    bankertrojangozi

  • Gozi family

    gozi

  • Xworm

    Xworm is a remote access trojan written in C#.

    trojanratxworm

  • Xworm family

    xworm

  • Downloads MZ/PE file

  • .NET Reactor proctector

    Detects an executable protected by an unregistered version of Eziriz's .NET Reactor.

  • Event Triggered Execution: Component Object Model Hijacking

    Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.

    persistenceprivilege_escalation

  • Executes dropped EXE

  • Loads dropped DLL

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery

  • Contacts third-party web service commonly abused for C2

    Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.

  • Drops desktop.ini file(s)

  • Drops file in System32 directory

  behavioral1