Extracted

• • Target
    d24ffa20079599159cac79cae2c78798eed1298f028e267ef04679a4b99272da.bin
  • Size 547KB
  • SHA256 d24ffa20079599159cac79cae2c78798eed1298f028e267ef04679a4b99272da
  • MD5 3151ee26118d1b83ef7d5d643ef90637
  • SHA1 571ed24bddb478a6d511feedccf671e42e9ec8b5
  • SHA512 f3a8a5a06513fc1cfa6af594496a16d5e838dc9825f455b5d1e11052a7e249fc5853f4d287ffd47885934278c696647470acd2d36a266c32ca8f81189889ed14
  • SSDEEP 12288:pYyDi5rNiQ7uysMFZzN/E/msumlke+f3rHEkBG:6yvgUlGf3rEk4
  • TLSH
    T1A3C48D11F7858FB5D59F8170C8A146A68A3BBC6A4F219BDF13847E293E326E04E35713
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  discoveryxwormpersistenceprivilege_escalationrattrojan

  • Detect Xworm Payload

  • Family: Xworm

    Xworm is a remote access trojan written in C#.

    trojanratxworm

  • Creates a file in the Startup directory

    A file was written to a Windows startup folder. Files in these directories are executed automatically when a user logs on or an application initializes.

    persistenceprivilege_escalation

  • Executes dropped EXE

  • Modifies system executable filetype association

    persistence

  • Adds Run key to start application

    persistence

  • Contacts third-party web service commonly abused for C2

    Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.

  behavioral1behavioral2