Extracted

• • Target
    081ed271f478bb537c8362360436cf8c9a1a2a33d2de125aacd69e1bec3a9431.bin
  • Size 467KB
  • SHA256 081ed271f478bb537c8362360436cf8c9a1a2a33d2de125aacd69e1bec3a9431
  • MD5 c2154f9a9b49afc280863f1ac4e890cf
  • SHA1 7fe4ae790ac7d5469588b7f0247aaebfb137a03c
  • SHA512 d8c50ab86414b5841a485fd8db53b14aeb47282acf4b872d852e7518866d3a873f050949d3c98dc75ffd0145e55c4ffb48f3819bf0a91810fa39ef789ac89a23
  • SSDEEP 12288:pYyDi5rNiQ7uysMFZzN/E/msumlkeUYTzUjD5lE9f:6yvgUlZTacf
  • TLSH
    T16FA49D01F79008F9E4A7867489A346569E35BC9B1B71EADF17C4632A2F337E08E39711
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  discoveryxwormpersistenceprivilege_escalationrattrojan

  • Detect Xworm Payload

  • Family: Xworm

    Xworm is a remote access trojan written in C#.

    trojanratxworm

  • Creates a file in the Startup directory

    A file was written to a Windows startup folder. Files in these directories are executed automatically when a user logs on or an application initializes.

    persistenceprivilege_escalation

  • Executes dropped EXE

  • Loads dropped DLL

  • Modifies system executable filetype association

    persistence

  • Adds Run key to start application

    persistence

  • Contacts third-party web service commonly abused for C2

    Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.

  behavioral1behavioral2