Extracted

• • Target
    0af431d9dc0f1fa617d4c38743c87126b87d592974c8ed48a575d9c1465ca049.bin
  • Size 53KB
  • SHA256 0af431d9dc0f1fa617d4c38743c87126b87d592974c8ed48a575d9c1465ca049
  • MD5 67e6934d6074c3c79ac06dd2e3dd6985
  • SHA1 4276af30a8b9d8514c87dcc12570bcb17cf6417a
  • SHA512 a6ae952ff5b823edfc9a6a5dd3a9852edccbc112ca044e72b0694e5ff8a89fc2e01807b7261a8d50a62066c2c841989ee007138ecd7cbecaae6c6bf35b54a4f6
  • SSDEEP 768:IeP8pVPFdDeCpLsDjS1fqb4Vco9Oshq8t4MNz4B4lSDtdwtPlSUJpHiMW:FEKCpIDjSsbbUOsk8dNzt0dTUJ8MW
  • TLSH
    T15333E76C2BD60129F1BFDF715EE1B253C67AE6635503DB5F0481062E0763E80CE5266E
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  executionhawkeyexwormkeyloggerpersistenceprivilege_escalationratspywarestealertrojan

  • Detect Xworm Payload

  • Family: HawkEye

    HawkEye is a malware kit that has seen continuous development since at least 2013.

    keyloggertrojanstealerspywarehawkeye

  • Family: Xworm

    Xworm is a remote access trojan written in C#.

    trojanratxworm

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Creates a file in the Startup directory

    A file was written to a Windows startup folder. Files in these directories are executed automatically when a user logs on or an application initializes.

    persistenceprivilege_escalation

  • Executes dropped EXE

  • Adds Run key to start application

    persistence

  • SmartAssembly .NET packer

    Detects SmartAssembly .NET packer.

  behavioral1behavioral2