Extracted

• • Target
    fileupgrade.exe
  • Size 11.5MB
  • SHA256 99b5c1ba63df912cc67b9fa13901b155d689d227ff47296278009f014c33bd50
  • MD5 c6896f52247ee709196704558b842de2
  • SHA1 a23b7d703fee1b4cedc8af8263fa1347f3c980a7
  • SHA512 f5fafbfeb62b562950f9cf60f4b9e176effb1c55c23c4b9361c616b08f94625edba6871f29f25b61bad042ea43cb30c62df766c21427f4220ec6367f4a264cf3
  • SSDEEP 196608:Y2r1Qsf9i7hwJ3O61r5pkhbAJTf4LCwBjBytYSfdwJPevc2Ag39V6lOTkrtW8:YJsfmwF7PQA6OwNBytLdw9ek+V6gTkr
  • TLSH
    T1D6C6338126A361B8F272C1B5A8870F29E73872C54358ACE727E3E6701DA95F15EF3417
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defense_evasiondiscoveryxwormpersistenceprivilege_escalationrattrojan

  • Detect Xworm Payload

  • Family: Xworm

    Xworm is a remote access trojan written in C#.

    trojanratxworm

  • Enumerates VirtualBox registry keys

    defense_evasion

  • Looks for VirtualBox Guest Additions in registry

    defense_evasion

  • Looks for VMWare Tools registry key

    defense_evasion

  • Looks for VMWare services registry key.

    defense_evasion

  • Creates a file in the Startup directory

    A file was written to a Windows startup folder. Files in these directories are executed automatically when a user logs on or an application initializes.

    persistenceprivilege_escalation

  • Executes a file named after a Windows system binary

    The file runs from a user directory while carrying the name of an executable that normally only exists in System32.

    defense_evasion

  • Executes dropped EXE

  • Loads dropped DLL

  behavioral1behavioral2