Extracted

• • Target
    a07f632478e504afcb69bff60ac8c1da97f1f416b1c5174e573a8ea7d6fe7d56.bin
  • Size 561KB
  • SHA256 a07f632478e504afcb69bff60ac8c1da97f1f416b1c5174e573a8ea7d6fe7d56
  • MD5 93061969e80df8144c710de1370bc590
  • SHA1 1d73d5bb8a0a776ddfa24646fd6cdebf86a5aef7
  • SHA512 fc1bb04823126c2bebe35d8755fed2cb34c540fc2801b1d04cd4702ae85bf95627d3db03fb6a817198c3ce04008b0bad6292088f2679184e17dec86a17994491
  • SSDEEP 12288:pYyDi5rNiQ7uysMFZzN/E/msumUlcUeTzUjD5VC9oU5DO69Q:6yvgUUgTa+pQ
  • TLSH
    T1EDC49D02F79048F9E9A7863088A246569F35BC9B1B61EADF1388731D1F337E08E39755
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  discoveryxwormpersistenceprivilege_escalationrattrojan

  • Detect Xworm Payload

  • Family: Xworm

    Xworm is a remote access trojan written in C#.

    trojanratxworm

  • Creates a file in the Startup directory

    A file was written to a Windows startup folder. Files in these directories are executed automatically when a user logs on or an application initializes.

    persistenceprivilege_escalation

  • Executes dropped EXE

  • Loads dropped DLL

  • Modifies system executable filetype association

    persistence

  • Adds Run key to start application

    persistence

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery

  • Contacts third-party web service commonly abused for C2

    Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.

  behavioral1behavioral2