Extracted

• • Target
    MasonClient1.exe
  • Size 47KB
  • SHA256 436ef87a7863e007ab6bf5808f9a1bdfc8b75e651f8ab6c5d627c0d4337e5a54
  • MD5 a250c21ab97b0c6b439c4ca660b5a62c
  • SHA1 be8f8371481a33e7623ef1221e22ce45e8b0fa02
  • SHA512 8bce88497b472a1d34df70f3990f2c075d6fc4d3dd8686749428b8ef6c80ef8b18724266182dd202d1a0c503a1704db9958657c7b565ce39e95cdf6e07abeb70
  • SSDEEP 768:9kTRIfcua3R2zdIXvYP73TYhBvop5DXsYNa4rb6Zqw4XZ4WhJO11Ho:9sIfcua3R2zdIXvYPjTYhBvG57sybrbR
  • TLSH
    T18F230A9D63E84121D8EF57F22D77D1419374AE638567D74F28C401CA2B22B99CB01AF3
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  xwormrattrojanadwarepersistencespyware

  • Detect Xworm Payload

  • Family: Xworm

    Xworm is a remote access trojan written in C#.

    trojanratxworm

  • Boot or Logon Autostart Execution: Active Setup

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

    persistence

  • Contacts third-party web service commonly abused for C2

    Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.

  • Enumerates connected drives

    Attempts to read the root path of hard drives other than the default C: drive.

  behavioral1behavioral2