Extracted

• • Target
    f35cec6ec49be6c27c67435975e1068620106b04f3216cba262f78d710d2e703.bin
  • Size 499KB
  • SHA256 f35cec6ec49be6c27c67435975e1068620106b04f3216cba262f78d710d2e703
  • MD5 c27fd1f016a2c319f3d2ab6d9bf7813a
  • SHA1 911525a34b4fcd21f02fe9a69c2b09d9ed39bb9b
  • SHA512 f7c3c2c73b20d854ff3e2565fdd8ffe48feb0c3badefcebce56dd137027e9315dcefb2923ae0c8d289876fc411a916be9e3356e1c4ef561b021cd85ae22ce1df
  • SSDEEP 12288:jYyDi5rNiQD+ysMFZzN/E/msumG7s0YyDi5rNiu:EyngUGiyu
  • TLSH
    T1BBB45A16F74418FCD99BC0B88A9745569A3978CF1B71BDEF0B8842262F62BF04E39750
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  xwormpersistenceprivilege_escalationratspywarestealertrojan

  • Detect Xworm Payload

  • Family: Xworm

    Xworm is a remote access trojan written in C#.

    trojanratxworm

  • Creates a file in the Startup directory

    A file was written to a Windows startup folder. Files in these directories are executed automatically when a user logs on or an application initializes.

    persistenceprivilege_escalation

  • Executes dropped EXE

  • Modifies system executable filetype association

    persistence

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Adds Run key to start application

    persistence

  • Contacts third-party web service commonly abused for C2

    Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.

  • Enumerates connected drives

    Attempts to read the root path of hard drives other than the default C: drive.

  behavioral1behavioral2