Extracted

Extracted

Extracted

• • Target
    open.cs
  • Size 1KB
  • SHA256 09be5c410052fc96ba5de93dae84afa4bd86f497fc5053ce078c95b07aa68d8f
  • MD5 ab484e28fa5edb79d07b468fe724a055
  • SHA1 f4c77971db049cf3a95457e11695962ab1ac9a21
  • SHA512 3ce49cd1d79faf2e18ea2c27727cbd0ca9a66671af7fd2d931eb5bc456b25f21ed7882827978be63b702f11c8a540d784ad100053dd8aa80fd7e2be689bac467
  • TLSH
    T19821AD22B78052775D36D6E16380F0A5EF792A539B730CA9F84C82A45F77A008635FA7
  • MD5 SHA1 SHA512 TLSH

  Score

  10^/10

  adwarediscoveryexecutionxwormpersistenceprivilege_escalationransomwareratspywaretrojan

  • Detect Xworm Payload

  • Family: Xworm

    Xworm is a remote access trojan written in C#.

    trojanratxworm

  • Badlisted process makes network request

    Network request originating from process or tool commonly abused by malware.

  • Command and Scripting Interpreter: PowerShell

    Run Powershell and hide display window.

    execution

  • Downloads MZ/PE file

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Event Triggered Execution: Component Object Model Hijacking

    Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.

    persistenceprivilege_escalation

  • Executes dropped EXE

  • Loads dropped DLL

  • Modifies system executable filetype association

    persistence

  • Uses the VBS compiler for execution

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery

  • Contacts third-party web service commonly abused for C2

    Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  behavioral1