Extracted

• • Target
    7fe35aa51ebee58294031cd85637f2a4162402294ebb839361df04e8f8179a84.bin
  • Size 35KB
  • SHA256 7fe35aa51ebee58294031cd85637f2a4162402294ebb839361df04e8f8179a84
  • MD5 e90f87861cb80d3fc3d00581377dd2fe
  • SHA1 fdcaabf665f24bd90b53bde6bbd6926822e67b38
  • SHA512 3dca4672c79e70be6d1444d5037a0a485eaf63b8dc7e60232af79c5d030618b582df44f41c4114b7e6d870690d9de6da32ed8c6819b0340a9e3c796286d8fcdf
  • SSDEEP 768:wEsfHwPsQ7457enbg/VbcjZPzF298KtOjhdn/N/:GfHwPz7457v/KtF298EOjLV/
  • TLSH
    T117F24C883B948325D5FE6FF56DF2B1050674F6079913EB5E0CC8899B2F63AC24A407E6
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  discoveryxwormrattrojanpersistenceprivilege_escalation

  • Detect Xworm Payload

  • Family: Xworm

    Xworm is a remote access trojan written in C#.

    trojanratxworm

  • Creates a file in the Startup directory

    A file was written to a Windows startup folder. Files in these directories are executed automatically when a user logs on or an application initializes.

    persistenceprivilege_escalation

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

    discovery
  behavioral1behavioral2