Extracted

• • Target
    eldoradologins.exe
  • Size 50.7MB
  • SHA256 2cfb3603a85505ff606d652d04b307d3d7b877eaf194b53067d9ebed5782cace
  • MD5 767168a13c94ef3c1f23a0a32a51cded
  • SHA1 47cfb1b62dbc66aba688d0a303ccef791454631f
  • SHA512 632d438d74f4c649d07927d4ea0b29962e8366bcf5c2b3d23570468ece5c115555246bf95e61a9f487afdb9f0980b13888b437ce61313f43b9b72acd766d01c3
  • SSDEEP 1572864:pVWS+BKWHz98dP10y+ZW+IPShlR7ols2nstO9/b/4GGq+w/:PWSUNHzOd90hVIarep2ORT4GG1w/
  • TLSH
    T191C733798724C126D788FCB57BABD360883F5F96C6D84032A5F45B97387983FA4A0B44
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defense_evasiondiscoveryxwormpersistenceprivilege_escalationrattrojan

  • Detect Xworm Payload

  • Family: Xworm

    Xworm is a remote access trojan written in C#.

    trojanratxworm

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Creates a file in the Startup directory

    A file was written to a Windows startup folder. Files in these directories are executed automatically when a user logs on or an application initializes.

    persistenceprivilege_escalation

  • Executes dropped EXE

  • Loads dropped DLL

  • Checks whether UAC is enabled

    defense_evasiontrojan

  • Contacts third-party web service commonly abused for C2

    Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.

  • Network Share Discovery

    Attempt to gather information on host network.

    discovery
  behavioral1behavioral2