Extracted

• • Target
    testfive.exe
  • Size 307KB
  • SHA256 668fbe0a962f0ef0f0229ab9304b2d48e260bcd04f2a4c60ff26f57fe5f5ccf2
  • MD5 114082b9dce8dc050c6f47f850340e10
  • SHA1 a9a2112663517cbb1ef9ec39d4759d09a880d830
  • SHA512 cff248a98c31e8eb077df7ca88d2661701cc9008a1fbab1aee2895f87155a7bea3ede237a7f627047bd5166377ffdb2def0e606850727ed4bb371f13f8470688
  • SSDEEP 6144:ZX7S4ve4BXH77GG9nZf1p8FwnQqpuXXmCa1c:VWgx9nZfQunQvHm
  • TLSH
    T1A3648C15F7A415F9EAA7C57CCA524506EB72BC030761EBCB03908AA72F236D49E3E711
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defense_evasionexecutionxmrigxwormminerpersistencerattrojanupx

  • Detect Xworm Payload

  • Family: Xworm

    Xworm is a remote access trojan written in C#.

    trojanratxworm

  • Family: xmrig

    XMRig is a high performance, open source, cross platform CPU/GPU miner.

    minerxmrig

  • XMRig Miner payload

    miner

  • Command and Scripting Interpreter: PowerShell

    Using powershell.exe command.

    execution

  • Downloads MZ/PE file

  • Creates new service(s)

    persistenceexecution

  • Executes dropped EXE

  • Stops running service(s)

    defense_evasionexecution

  • Obfuscated Files or Information: Command Obfuscation

    Adversaries may obfuscate content during command execution to impede detection.

    defense_evasion

  • Drops file in System32 directory

  • Executes a VBScript file via the Windows Script Host.

    execution

  • Suspicious use of SetThreadContext

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  behavioral1behavioral2