Extracted

• • Target
    e64794c1ad4f67236308251d84a4523375ec8557252adb43f5df0c3782c871eb.bin
  • Size 134KB
  • SHA256 e64794c1ad4f67236308251d84a4523375ec8557252adb43f5df0c3782c871eb
  • MD5 271330336f20c508f438740bbe9c8df6
  • SHA1 390008812955f206534f8b52e610aeacee0f65c1
  • SHA512 1013f2f5ff49e15a83d9d436c8c5b1b0e5b31c44bd196842517eea1d2e8419936787bc2e1e1eca994d8b6d0df2e99d39831885daafa62768253a8b7150661e0e
  • SSDEEP 3072:ozGC+e922g+3vJB1oRLo22QsEPC0o6gjOT:mwd+CR822Wp4y
  • TLSH
    T1DAD37D4BB3E631F9E473823989A14645E772787507209BEF03A443566F23AD58D3EB22
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  executionxwormrattrojan

  • Detect Xworm Payload

  • Family: Xworm

    Xworm is a remote access trojan written in C#.

    trojanratxworm

  • Command and Scripting Interpreter: PowerShell

    Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

    execution

  • Downloads MZ/PE file

  • Executes dropped EXE

  • Contacts third-party web service commonly abused for C2

    Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.

  behavioral1behavioral2