Extracted

• • Target
    e4d1ac2f6e9cb8a2a427d230c56c67438fc5fa5def41904f2bcb54f3c4b74857.bin
  • Size 2.0MB
  • SHA256 e4d1ac2f6e9cb8a2a427d230c56c67438fc5fa5def41904f2bcb54f3c4b74857
  • MD5 38b895dd947f88d26fa45062e4f0718d
  • SHA1 ecd83488fdadfb43ffaf5d7fc1ce228ae7dc51e0
  • SHA512 ed671ed5dfab4e55ed55861590d12fca2d7648265eccf76c533ba38a7ce5b0ddc4d3643cc703d8fd3637757f0b2e6b962a22fe362fb1c25b0a2c77a767915f7d
  • SSDEEP 24576:6yvgUlTRHcCdOYtaZR9/uwZM49HkA8N/JYiToIlO70oD:0QR84taZfRZM4dRw/tTMV
  • TLSH
    T10EA58C07F65544E9C05AC178CB46C632EA71BC8A0B75A9EF13906B163E76BE01F3E721
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  xwormpersistenceprivilege_escalationrattrojan

  • Detect Xworm Payload

  • Family: Xworm

    Xworm is a remote access trojan written in C#.

    trojanratxworm

  • Creates a file in the Startup directory

    A file was written to a Windows startup folder. Files in these directories are executed automatically when a user logs on or an application initializes.

    persistenceprivilege_escalation

  • Executes dropped EXE

  • Modifies system executable filetype association

    persistence

  • Adds Run key to start application

    persistence

  • Contacts third-party web service commonly abused for C2

    Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.

  behavioral1behavioral2