Extracted

• • Target
    mal.exe
  • Size 406KB
  • SHA256 f306f95f4a9b8b5f708e349465614c67ed2e60a13f2d28efefc7fc78c223e51e
  • MD5 2cb69abed9d824a2d7e65bac470e7c42
  • SHA1 cb2da5677b650a554a89dda3b65d8107e28013a2
  • SHA512 af583576119b0f8d53c678e5c213cd9a052afe80c1e3e12827674aac458f011510679ade8962156c7f92cafe3ee93a1c4cfcc8a5e56077955e74c8c9c85365a9
  • SSDEEP 6144:Cwq3Nplp8rtzZ3vxjmMAQFEY86jgGf5LYR1tQ73cnfU71437A2M+TRwyCUP8g++C:CzhufPAgEYFV33yl+sg1hfzzoo
  • TLSH
    T15494B0523D0CA5DBEE3D2373196685862FF4787A4B92169F7AABF25648023034E1FD1C
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  discoverypersistencexwormrattrojan

  • Detect Xworm Payload

  • Family: Xworm

    Xworm is a remote access trojan written in C#.

    trojanratxworm

  • Loads dropped DLL

  • Adds Run key to start application

    persistence

  • Suspicious use of NtCreateThreadExHideFromDebugger

  • Suspicious use of NtSetInformationThreadHideFromDebugger

  behavioral1behavioral2
• • Target
    $PLUGINSDIR/System.dll
  • Size 11KB
  • SHA256 bd046e6497b304e4ea4ab102cab2b1f94ce09bde0eebba4c59942a732679e4eb
  • MD5 17ed1c86bd67e78ade4712be48a7d2bd
  • SHA1 1cc9fe86d6d6030b4dae45ecddce5907991c01a0
  • SHA512 0cbed521e7d6d1f85977b3f7d3ca7ac34e1b5495b69fd8c7bfa1a846baf53b0ecd06fe1ad02a3599082ffacaf8c71a3bb4e32dec05f8e24859d736b828092cd5
  • SSDEEP 192:eY24sihno00Wfl97nH6T2enXwWobpWBTU4VtHT7dmN35Ol+Sl:E8QIl975eXqlWBrz7YLOl+
  • TLSH
    T1E3325C12135081F3E4918138C86B3A276B6A15029BF98E57DFD39546BE31BE3BD7D603
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  3^/10

  discovery
  behavioral3behavioral4