Extracted

• • Target
    00e71afd1a43c6f708626d5e58f35233370eee3cf9e56dde73dbe3484a56a0d2.bin
  • Size 824KB
  • SHA256 00e71afd1a43c6f708626d5e58f35233370eee3cf9e56dde73dbe3484a56a0d2
  • MD5 a76939489ba7f586085109fb1122d3de
  • SHA1 364b5c5e5f44090faf74ebdd1c8fef856f50d440
  • SHA512 5258cb52f618ddb0440eb852ab3c07b706232456cb5ff2e2737baef54a760e3c9e700cd11e1fc74d22c21c0f421da9f81fee96e04d077ba17247b9c80952b92d
  • SSDEEP 12288:jYyDi5eJQ7uysMFZzN/E/msumBs1mMBtazauC+WpCQjaId3:EavgUByoegWEQBd3
  • TLSH
    T146055D4AF74804E8D19BD1B886938A06FB717C8A0761EBCF07E997675F236E05E39311
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  xwormpersistenceprivilege_escalationratspywarestealertrojan

  • Detect Xworm Payload

  • Family: Xworm

    Xworm is a remote access trojan written in C#.

    trojanratxworm

  • Creates a file in the Startup directory

    A file was written to a Windows startup folder. Files in these directories are executed automatically when a user logs on or an application initializes.

    persistenceprivilege_escalation

  • Executes dropped EXE

  • Modifies system executable filetype association

    persistence

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Adds Run key to start application

    persistence

  • Contacts third-party web service commonly abused for C2

    Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.

  • Enumerates connected drives

    Attempts to read the root path of hard drives other than the default C: drive.

  behavioral1behavioral2