Extracted

• • Target
    d0d924d6289c57668e9c009119df307b2a3b90ff652d9464eaf8eba66e6f3189.bin
  • Size 4.6MB
  • SHA256 d0d924d6289c57668e9c009119df307b2a3b90ff652d9464eaf8eba66e6f3189
  • MD5 1e6c5f23dd4890973d57eb503c5cb830
  • SHA1 a3dfb21830e2eb5ce21aff5533f3115b9abadc19
  • SHA512 38b159821f4fdebf80d9cbed3a0ae5f382311772d3e13bb1cc8467d2ca8f8fc30410c38d93b10247d9a2d86408aa1b76e840fb51ff5e2814ff3e595aec52e2ce
  • SSDEEP 98304:ef5aTkl4ZG8WSRwyhAvAPRf/rTCnP0Kgqai+3SYZCs9Zy2MC5MpUDzy:2aAlCG8WS9heq6sKgqaHi+Cs9ZXMYG
  • TLSH
    T1A026ABAC7FFCD4E1DDAF16BA233FD4D0468C99051AB3CC3ADA2A295546A39F4035A41C
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  executiondarksideratxwormpersistenceprivilege_escalationrattrojan

  • Detect Xworm Payload

  • Detects DarkSideRAT

  • Family: DarkSideRAT

    DarkSideRAT is a remote access trojan.

    trojandarksiderat

  • Family: Xworm

    Xworm is a remote access trojan written in C#.

    trojanratxworm

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Creates a file in the Startup directory

    A file was written to a Windows startup folder. Files in these directories are executed automatically when a user logs on or an application initializes.

    persistenceprivilege_escalation

  • Executes dropped EXE

  • Adds Run key to start application

    persistence

  • Suspicious use of SetThreadContext

  behavioral1behavioral2