Extracted

• • Target
    91ec9a5957168f9a01c76b1961b73e57aac966a26085c82c8420654ef092418d.bin
  • Size 3.0MB
  • SHA256 91ec9a5957168f9a01c76b1961b73e57aac966a26085c82c8420654ef092418d
  • MD5 dddbaf6cad3e9f4569d4faa5ea214e35
  • SHA1 b4051c4e1b4766b43c1e28a9c69261f15e457c33
  • SHA512 b36144fb3f6a8711e5922d1ce436eed2bda4d5194b943bdc291d3fc5bdae46becf75a9b6f1ecc7ccf3cbd8c30c645e351873a2c1611ee484012cd10620fffe28
  • SSDEEP 49152:0GMf/lLo51rBmmWOZO9SEmBCp2BDseKECCJPpDrbqcjo/xcawYl0UMRlZ:6/h4tZNh7XExcawr
  • TLSH
    T1A8E59EA07658C866E516247E55B53A84402CF8E6D7B108CFBFC03DA47636AD3ED3A327
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  discoveryxwormpersistenceprivilege_escalationrattrojan

  • Detect Xworm Payload

  • Family: Xworm

    Xworm is a remote access trojan written in C#.

    trojanratxworm

  • Creates a file in the Startup directory

    A file was written to a Windows startup folder. Files in these directories are executed automatically when a user logs on or an application initializes.

    persistenceprivilege_escalation

  • Executes dropped EXE

  • Modifies system executable filetype association

    persistence

  • Adds Run key to start application

    persistence

  • Contacts third-party web service commonly abused for C2

    Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.

  behavioral1behavioral2