Extracted

• • Target
    57afb35516703e5ff25916dbea949dce4872527d66049a92a587e9417f6dfdd7.bin
  • Size 546KB
  • SHA256 57afb35516703e5ff25916dbea949dce4872527d66049a92a587e9417f6dfdd7
  • MD5 026a390f1931d77dbad1ceb1fe1cb271
  • SHA1 3dba2a3199a80545072ccbe4f40f2af268020e86
  • SHA512 444c8d5c765d476d4ce917811ffb46331ad85fa6825d508aa836625241ca6493eb42ff83895fc92e8e8e4d84cf187f893258313f9130b056e14fc5c23d5aa2e7
  • SSDEEP 12288:pYyDi5rNiQ7uysMFZzN/E/msumlkeGImGUcsvZZdubv7u2l3z:6yvgUluxGBcslj
  • TLSH
    T178C49E11F7D044F9D4A7853489A246529E39BCAA1F71EEDF13C8432A1F327E08E39766
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  discoveryxwormpersistenceprivilege_escalationrattrojan

  • Detect Xworm Payload

  • Family: Xworm

    Xworm is a remote access trojan written in C#.

    trojanratxworm

  • Creates a file in the Startup directory

    A file was written to a Windows startup folder. Files in these directories are executed automatically when a user logs on or an application initializes.

    persistenceprivilege_escalation

  • Executes dropped EXE

  • Modifies system executable filetype association

    persistence

  • Adds Run key to start application

    persistence

  • Contacts third-party web service commonly abused for C2

    Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.

  behavioral1behavioral2