Extracted

• • Target
    libvlc.dll
  • Size 1.2MB
  • SHA256 2916de0bf4123a26386578169f012b2e76fd2ee7014ca9f5cd40efe65c9e8102
  • MD5 cc252dd8bbb8ec946894662245939e9d
  • SHA1 728cd4c1ed7f625399abcf77f2e6263ae36a4995
  • SHA512 aedece362df6a5625907f9e00fca5fa8eafde95c890320a39a642adcc152e72bd1555ed33590becf0948170b932ec54ec7eda0a97e37b07173f874a52532a9b4
  • SSDEEP 12288:cYx04hHU2VtxGardthvDDnoap6KOrrDnk9TQ1sOox2r4m82ljM8zVwWrrg:Tx04hHUoFlfsfuTQyOJrr82VdzVwd
  • TLSH
    T1EC55BF43DB1264F6CDABC7B5435B815AC622355A03E629BB02789BFCE622705773EF10
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defense_evasionexecutionxwormpersistencerattrojan

  • Detect Xworm Payload

  • Family: Xworm

    Xworm is a remote access trojan written in C#.

    trojanratxworm

  • Badlisted process makes network request

    Network request originating from process or tool commonly abused by malware.

  • Loads dropped DLL

  • Adds Run key to start application

    persistence

  • Drops file in System32 directory

  • Hide Artifacts: Hidden Files and Directories

    defense_evasion
  behavioral1behavioral2
• • Target
    vlc.exe
  • Size 1021KB
  • SHA256 bfa5740f028a8f310ca01c779bbc5f2f1b435c41539c54de592f715bb0c10389
  • MD5 f0a4d5c3492115bfe2f346bc7bdce396
  • SHA1 bfcbdc7d0cbb92b68d348090fe9f381b4358a587
  • SHA512 8e4b2e1852fbc821cab4a7c16675afbfa2588472faa1848600829c415bfbee7cbf4713568ba15a76916e6c761d79b0fff7c5a1ae087aabd912bb7063d38a560a
  • SSDEEP 24576:uGKuKkPztKt9cHPrLRAqKBAy1N1UGAmnnnFnnnZnnnGnnnsddodt:uGKuKkPzgt9cHTLRAqK81k8
  • TLSH
    T1A9254B1BE7A345EDC56FC13487A7C772AA30B86942347E2E1D95DB221F10E609F2E724
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defense_evasionexecutionxwormpersistencerattrojan

  • Detect Xworm Payload

  • Family: Xworm

    Xworm is a remote access trojan written in C#.

    trojanratxworm

  • Adds Run key to start application

    persistence

  • Hide Artifacts: Hidden Files and Directories

    defense_evasion
  behavioral3behavioral4