Extracted

• • Target
    File~-~.Document.exe
  • Size 20.0MB
  • SHA256 4b840844ce458265427c1d9f11917bd94b84561ae7add3252e56cfb8f567e305
  • MD5 183edf6dd1ef070eb3d386090354acaf
  • SHA1 832e66d84888acdab6232662f19c2b33bd4990e6
  • SHA512 9a21f13264d293579a15e48d999313d04966d9504b9578434594986f1a859e1f68a11bab56d6816db3abefc53ab109629de97229770ab8122cc1cfd7bc0373c8
  • SSDEEP 196608:DrBXt5LXCuz9eL5FUtX48nvhbTWxszcRNdBMKSrXegGW9nsAy:nFt5LXCuz9eL5FUtX48nvoaQYtnsAy
  • TLSH
    T11B27290567F98194F1F797349AB28787DA76BC416B34C68F0250620E1E73AE0DE7A732
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  xwormpersistencerattrojan

  • Detect Xworm Payload

  • Family: Xworm

    Xworm is a remote access trojan written in C#.

    trojanratxworm

  • Adds Run key to start application

    persistence
  behavioral1behavioral2
• • Target
    version.dll
  • Size 1.1MB
  • SHA256 4cebc91bb721bcca059b0ac117129179daf6a9e316fcee2dc2c23231e7d6cebd
  • MD5 ec0443fa4c60a1304e5d5a96d7d56f95
  • SHA1 22856d8fb5e9b51f64f2533a2d75873a95dbc02b
  • SHA512 9ebb32cee317d888d9dc5e7f4ef6fad6431666a95a2517ac8d7cf165ea4002cb3150a1e98a305697fa0df8291b8bf99623338ede4e779c6a43c420b840bfe1ba
  • SSDEEP 24576:KgB1c74GMgE0dQuYuOvp6wGfm8TRIWWvDwnPFRBNchbZUuV:K61cLMH0dS9mrRqzk
  • TLSH
    T1AF45F15453C441F1E0B9CA748A23A66DD27B3D1E0750AEFF03B04A6DBF36BC99529E42
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  xwormpersistencerattrojan

  • Detect Xworm Payload

  • Family: Xworm

    Xworm is a remote access trojan written in C#.

    trojanratxworm

  • Badlisted process makes network request

    Network request originating from process or tool commonly abused by malware.

  • Adds Run key to start application

    persistence

  • Drops file in System32 directory

  behavioral3behavioral4