Extracted

• • Target
    e88b1c10c232c78490d1358ab86ff899247c3c30af454a7e9afb63754fefa8d3.bin
  • Size 561KB
  • SHA256 e88b1c10c232c78490d1358ab86ff899247c3c30af454a7e9afb63754fefa8d3
  • MD5 50803c6c0b4b6c488a689fdaca0560cf
  • SHA1 ef214a4ca7f023a3cb22d1ebd5c4168ab460264a
  • SHA512 15d5280201bfb24cf904c438e6a9da48d2713fe2a0ddf7c50a61638634150a13372296d55ce42c22cd257521412bed1270b9b9177f4880390ba7bfcd13ba2b5c
  • SSDEEP 12288:pYyDi5rNiQ7uysMFZzN/E/msumlkeUCTzUjD5FZ9oU5DO69S:6yvgUlzTK7pS
  • TLSH
    T169C49E02FB9048F9E9A7863088B246569F35BC9A1B61EADF1384731D1F337E08E39755
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  discoveryxwormpersistenceprivilege_escalationrattrojan

  • Detect Xworm Payload

  • Family: Xworm

    Xworm is a remote access trojan written in C#.

    trojanratxworm

  • Creates a file in the Startup directory

    A file was written to a Windows startup folder. Files in these directories are executed automatically when a user logs on or an application initializes.

    persistenceprivilege_escalation

  • Executes dropped EXE

  • Loads dropped DLL

  • Modifies system executable filetype association

    persistence

  • Adds Run key to start application

    persistence

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery

  • Contacts third-party web service commonly abused for C2

    Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.

  behavioral1behavioral2