Extracted

• • Target
    xe0da95e6485b453183c7821613fd97b122593caf182cd6f8ce0014e38dd932c9.exe
  • Size 1.2MB
  • SHA256 e0da95e6485b453183c7821613fd97b122593caf182cd6f8ce0014e38dd932c9
  • MD5 18289d37f36ac0094099e8185eae6a25
  • SHA1 0ee16b9ef50b5978ce0741754b2e6f11f139db2f
  • SHA512 f2d47fe3c7c12dd63e0b3117d9ff7eb98564ade6d06a75c947bd7cff16ed4a96ade127f5c100295193ad888237c51c9d8e3faed9babbf1bd30967652c9096276
  • SSDEEP 12288:pYyDi5rNiQDuysMFZzN/E/msumG7soYyDi5rNiQDuysMFZzN/E/msumG7s0Zc0Io:6y3gUGuy3gUG3MYenGJiKEbXWtpOLlM
  • TLSH
    T16045BF22F79404B9D5A78071C9568161AE3DB84E1F31E9EF07C8872E2F366E09F3A355
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  discoveryxwormpersistencerattrojan

  • Detect Xworm Payload

  • Family: Xworm

    Xworm is a remote access trojan written in C#.

    trojanratxworm

  • Drops startup file

  • Executes dropped EXE

  • Loads dropped DLL

  • Modifies system executable filetype association

    persistence

  • Adds Run key to start application

    persistence

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery

  • Contacts third-party web service commonly abused for C2

    Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.

  behavioral1behavioral2