Extracted

• • Target
    sticker.webp
  • Size 13KB
  • SHA256 0ab704323fd5dd58bce8a302ff9e049c18cbae59c4350a85e86b6ff9c684b356
  • MD5 a699dd76ffba2bb49bf96463cb59c481
  • SHA1 ffab8a7ad11ff0d3ea930199b7e331ebfa5c8b70
  • SHA512 0e0bf8d14b3901c5d69299273049c89609eed8351ccd2671b598eb3564bc084a4b3f92b34592c88e162270773c75dad1cd2c9a3122c3ce506359882d057f0df2
  • SSDEEP 384:B8E1p9qYnGPX893noO64mNMYTI6Qw8SFLqyLLkJDz:CE1Nn39qMaI0L7cJP
  • TLSH
    T1FF52C059CF6F185774ADA73648F0E8D7812557CDE8C25D4BE4B9225EF372C2A2910B30
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  agilenetdiscoveryexecutionxwormrattrojan

  • Detect Xworm Payload

  • Family: Xworm

    Xworm is a remote access trojan written in C#.

    trojanratxworm

  • Executes dropped EXE

  • Loads dropped DLL

  • Obfuscated with Agile.Net obfuscator

    Detects use of the Agile.Net commercial obfuscator, which is capable of entity renaming and control flow obfuscation.

    agilenet

  • Uses the VBS compiler for execution

  • Contacts third-party web service commonly abused for C2

    Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.

  • Drops file in System32 directory

  behavioral1behavioral2