Extracted

• • Target
    773ed333303540dab5f274d05964180d43bf9910b3cd32d7d6f0d8d5905f3b89.bin
  • Size 5.1MB
  • SHA256 773ed333303540dab5f274d05964180d43bf9910b3cd32d7d6f0d8d5905f3b89
  • MD5 781d4b3cbd56e81f665249134e581adf
  • SHA1 aefda7dc092eff4247e6c6d43d06a25b2aab0007
  • SHA512 3a87889a02685c1ecdbcafcf445ae6b52a9ade337c5787b6b0b8929b710d94c16748689a72defae1c30b0e856f1d60fd1dfde29e35591cdae6cdab3383efe992
  • SSDEEP 384:Moy/d+dmSvyCplEGgOWfvbgD0Wvcix4iIseJVci1NtRiDZoB6LGlUESaE7FZr/ft:eOwuhB
  • TLSH
    T10E464053E689C9EDC481CCFAF05374B47946DF87E1482A9C28DDE02C0F66E536E26C66
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  discoveryexecutionxwormrattrojan

  • Detect Xworm Payload

  • Family: Xworm

    Xworm is a remote access trojan written in C#.

    trojanratxworm

  • Process spawned unexpected child process

    This typically indicates the parent process was compromised via an exploit or macro.

  • Badlisted process makes network request

    Network request originating from process or tool commonly abused by malware.

  • Command and Scripting Interpreter: PowerShell

    Run Powershell and hide display window.

    execution

  • Enumerates connected drives

    Attempts to read the root path of hard drives other than the default C: drive.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2