Extracted

• • Target
    5435a48e633b97d64809a9257a5daa271b80a74899e7760a30800be918c94ba9.bin
  • Size 986KB
  • SHA256 5435a48e633b97d64809a9257a5daa271b80a74899e7760a30800be918c94ba9
  • MD5 d3e1160be844b42345d07e9787084b20
  • SHA1 adff82e1ab281f7d5c001feb47581e01da745eb6
  • SHA512 d3869c7133a53e0c45d6b51f736608423e4f48344042411dfa25284c3aaa22c0b48ad412ee815ef205353787f769c46025072858e3a9115fcedcc28d5a2760a9
  • SSDEEP 24576:6yvgUlL5mWpI2jFM5sFzfTpiTLbo8NON56hlS:0A5BjBbTpiXbo8NONaS
  • TLSH
    T13C25AE32F6600076EAF201B2E96891317E3CB6291760D9EF93C4992D3E759E15F7B312
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  discoveryxwormpersistenceprivilege_escalationrattrojan

  • Detect Xworm Payload

  • Family: Xworm

    Xworm is a remote access trojan written in C#.

    trojanratxworm

  • Creates a file in the Startup directory

    A file was written to a Windows startup folder. Files in these directories are executed automatically when a user logs on or an application initializes.

    persistenceprivilege_escalation

  • Executes dropped EXE

  • Loads dropped DLL

  • Modifies system executable filetype association

    persistence

  • Adds Run key to start application

    persistence

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery

  • Contacts third-party web service commonly abused for C2

    Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.

  behavioral1behavioral2