Extracted

• • Target
    df4d60a6998a2a92dd59b4c47b914ffdb1460be900505582753acbf9b6b217bb.bin
  • Size 763KB
  • SHA256 df4d60a6998a2a92dd59b4c47b914ffdb1460be900505582753acbf9b6b217bb
  • MD5 917afea55c394aa99d392a17f1f79936
  • SHA1 fe9da84db8bb9d7f667bbd308160ccdd7583b58e
  • SHA512 8617e4e41ec6abc141adeebac913b66439b97ccfc8637d91720a2ab3f854f43690ce16d0e1c3912c98c90be047332e1e5e5dcf1af2376f706674c5a82070d657
  • SSDEEP 12288:pYyDi5rNiQ7uysMFZzN/E/msumlkebfrp6GbKvqjGELQwJMNKbMPKKTly:6yvgUlTrp6GuvqjfMNdKKTQ
  • TLSH
    T186F40503A69C3CE9D476927867B787C2E73EBC451762D6DF02C042291E2F6A27E35790
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  xwormpersistenceprivilege_escalationrattrojan

  • Detect Xworm Payload

  • Family: Xworm

    Xworm is a remote access trojan written in C#.

    trojanratxworm

  • Creates a file in the Startup directory

    A file was written to a Windows startup folder. Files in these directories are executed automatically when a user logs on or an application initializes.

    persistenceprivilege_escalation

  • Executes dropped EXE

  • Modifies system executable filetype association

    persistence

  • Adds Run key to start application

    persistence

  • Contacts third-party web service commonly abused for C2

    Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.

  behavioral1behavioral2