Extracted

• • Target
    753e66e7442811045445ff59b482f009598b436b602a80b446562b8d2c69b1fa.bin
  • Size 839KB
  • SHA256 753e66e7442811045445ff59b482f009598b436b602a80b446562b8d2c69b1fa
  • MD5 c3396ba97cfc406938a4dda1b678ee6d
  • SHA1 8a87b9aa94857dd814959b2764bf5ba70aa99317
  • SHA512 fe2758a882b28cbf8ec9a7342f4421da82058a4a0e384b517840c393912a8cc76f7fa19d410d2aed4d86ae30997f181286d4fb9463cc222bc6ec4a14f058d9d6
  • SSDEEP 24576:qKqpCZGE96zN4tqEKmJM60PkE16YeGVBhEv748BdEU9RcxPSi7OWBBJfwCVVQNI0:T0oB
  • TLSH
    T13205AD066AEC01FAD2A6D33989E35582E7F73D5793055FCB02E48D4A3E971D0A87E324
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  xwormpersistenceprivilege_escalationratspywarestealertrojan

  • Detect Xworm Payload

  • Family: Xworm

    Xworm is a remote access trojan written in C#.

    trojanratxworm

  • Creates a file in the Startup directory

    A file was written to a Windows startup folder. Files in these directories are executed automatically when a user logs on or an application initializes.

    persistenceprivilege_escalation

  • Executes dropped EXE

  • Modifies system executable filetype association

    persistence

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Adds Run key to start application

    persistence

  • Contacts third-party web service commonly abused for C2

    Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.

  • Enumerates connected drives

    Attempts to read the root path of hard drives other than the default C: drive.

  behavioral1behavioral2