Extracted

• • Target
    0187df66f272f641f686935b20719bd8bc0ec21134195ede60223cefaa452a9c.bin
  • Size 636KB
  • SHA256 0187df66f272f641f686935b20719bd8bc0ec21134195ede60223cefaa452a9c
  • MD5 a39be0518a03d61b2e06354d473d2e10
  • SHA1 e3ff4126343bb3c5933415fc2b20890c52098a9e
  • SHA512 ddbad7192f0e1d0ac89c03ab64fbb184790946eefae5acb9fc013abc27763f37b7304fc88b2e9ee3104aa7823d967c0b6f84e44561c770a2e20550365ae8ad59
  • SSDEEP 12288:pYyDi5rNiQ7uysMFZzN/E/msumUlcL0WF6Tecnhzd5c:6yvgUUZLzd5c
  • TLSH
    T1D6D45A07F75808B9D89BC17886929516EA35BC4E0B31F9DF03C85B262E27BE05F39B54
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  xwormpersistenceprivilege_escalationrattrojan

  • Detect Xworm Payload

  • Family: Xworm

    Xworm is a remote access trojan written in C#.

    trojanratxworm

  • Creates a file in the Startup directory

    A file was written to a Windows startup folder. Files in these directories are executed automatically when a user logs on or an application initializes.

    persistenceprivilege_escalation

  • Executes dropped EXE

  • Modifies system executable filetype association

    persistence

  • Adds Run key to start application

    persistence

  • Contacts third-party web service commonly abused for C2

    Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.

  behavioral1behavioral2