Extracted

• • Target
    fbb90d6bf806721e5a15b84dda0e0438272e2dba81bdf7d3eb55f490d4419ab2.bin
  • Size 426KB
  • SHA256 fbb90d6bf806721e5a15b84dda0e0438272e2dba81bdf7d3eb55f490d4419ab2
  • MD5 0853f4ab5af04d54636bb30c2925cbd5
  • SHA1 b862ef7d9c17ac82e25c6769101e62b0785845e1
  • SHA512 1443813325640ad35527acad838ced2e73e13e59f1a1774372360cd18063b7de682795a8b526e0e2395c8463bd467b06d90cdf253bb349ac8900d8fd7c20549f
  • SSDEEP 6144:p+GYnA0zeWsDi5rJziQ8kV3f+RysMFZzN/E/msHOtbMrJW8sIrwl7k/a4b:pYyDi5rNiQ7uysMFZzN/E/msumlkeRyA
  • TLSH
    T14794AE06F74408F9E49BC57489A355469A397C8B0B71FAEF1BC8422A1F337E08E39759
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  xwormpersistenceprivilege_escalationrattrojan

  • Detect Xworm Payload

  • Family: Xworm

    Xworm is a remote access trojan written in C#.

    trojanratxworm

  • Creates a file in the Startup directory

    A file was written to a Windows startup folder. Files in these directories are executed automatically when a user logs on or an application initializes.

    persistenceprivilege_escalation

  • Executes dropped EXE

  • Modifies system executable filetype association

    persistence

  • Adds Run key to start application

    persistence

  • Contacts third-party web service commonly abused for C2

    Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.

  behavioral1behavioral2