Extracted

• • Target
    ed8be55295c99625f19b69c4382c317ae2b350d128725f1daba9082c1be6210c.bin
  • Size 798KB
  • SHA256 ed8be55295c99625f19b69c4382c317ae2b350d128725f1daba9082c1be6210c
  • MD5 57d024fd60e3f1c98333390971350730
  • SHA1 f606eb81e355e2e6380cbc60680d649252ec96df
  • SHA512 05c34f737da52cfcd07a065d5879028a04e1e6ecf6530d868a8e903acac07a400ad788b1b8e469266c8de281c15afba4f699bea34f1832e3a89309e83100a25a
  • SSDEEP 24576:6yvgUl12NEHd0EKpxtJFteSi5t89TMFZ2qr6:0w2NEHJKrtJFvwt89TMn246
  • TLSH
    T19805BE16F780C4B6C47741348E9283959A79F8BA0B31959F77D88B7E2F316E08E38B51
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  discoveryxwormpersistenceprivilege_escalationrattrojan

  • Detect Xworm Payload

  • Family: Xworm

    Xworm is a remote access trojan written in C#.

    trojanratxworm

  • Creates a file in the Startup directory

    A file was written to a Windows startup folder. Files in these directories are executed automatically when a user logs on or an application initializes.

    persistenceprivilege_escalation

  • Executes dropped EXE

  • Modifies system executable filetype association

    persistence

  • Adds Run key to start application

    persistence

  • Contacts third-party web service commonly abused for C2

    Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.

  behavioral1behavioral2