Extracted

• • Target
    MenuV2.rar
  • Size 741KB
  • SHA256 ca2d4b59516509c4ae1861a252be838cb58e6aeee8f3294df405204e964a5c4e
  • MD5 26f0acf3a2b34536d6685207add19ecf
  • SHA1 7644dadc627d99c0a913e1a45ba427e25f7a8a41
  • SHA512 3cf71d752075c9e8f25595ecc27fb5404ff1d7a4b097c186cba8dec60c293779157a8b618f583e974e39823d437c2cdac3058bd9842ffec2a82658a46e66d9e0
  • SSDEEP 12288:ptyBriqoTKsX2ayvr5fEFyUT93NiMeN1PVNFC06LtjsCJ9JHfJae0bxKchypYNTS:j0riqJker58FygYMe5NFQlHJ/we0bgce
  • TLSH
    T136F43342E1668CB068D69C6DDC71EED1E2F208C1513FF0591C6D0CAEBA3E6D625BB6C1
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  executionxwormpersistencerattrojan

  • Detect Xworm Payload

  • Family: Xworm

    Xworm is a remote access trojan written in C#.

    trojanratxworm

  • Command and Scripting Interpreter: PowerShell

    Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

    execution

  • Drops startup file

  • Executes dropped EXE

  • Adds Run key to start application

    persistence

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  behavioral1
• • Target
    MenuV2.exe
  • Size 748KB
  • SHA256 b25eb7be7027a8a28d06a9c1fbea75d43116111bbaed3aa0d549b6d3ac90bab4
  • MD5 5f0d461210ca6dba34f3fa4adb952ac8
  • SHA1 21f2a762cc0205043a22bfafbb203f9ac82c6ef0
  • SHA512 6efc85babe5a304c5c815cc320880d10f3657dd7e78aea9c0bf10daa80c81b95e7f7627f0f4d3a8028ca25f914abae7547999fc333596849808115ea8dcdf2d8
  • SSDEEP 12288:kc5K8fRXOGtBupFYRoKYOEvyPtG3LG7ghRhJX2OaGnn+jTFd/4ZzoSOpwT37MMp:R1OaBMAtPEvy1qLwgDhJXdnakznOpwT6
  • TLSH
    T187F42338473D4375F42A0E362B96EA41824F2A9CCE670DC70D285B7B17D13A366E3563
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  xwormrattrojan

  • Detect Xworm Payload

  • Family: Xworm

    Xworm is a remote access trojan written in C#.

    trojanratxworm

  • Executes dropped EXE

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  behavioral2
• • Target
    config/config.json
  • Size 1KB
  • SHA256 b922e14523ccd35db3303b92b0c1e9cd4e2c241aabbc32add3528be483b8aace
  • MD5 6c7ee8aeaec77fc8392b2cbef9dd5b2d
  • SHA1 cb51c6ea8d5f57399b54754a2d2ce54fc7a62e14
  • SHA512 194dfdf2f55e42efc384f413ccf1e32358008fb297ef4072baeae7a354942b71281a2d9e2dcfdc8f72da88bade92b23743e45ff52b6dc3e0046aa048e48d6ea5
  • TLSH
    T1FA21F40A1252E4E6C0938294437C9B4B363CE8F36832DB91F514A16EA98F13AF74453B
  • MD5 SHA1 SHA512 TLSH

  Score

  3^/10
  behavioral3