Extracted

• • Target

    IMG_2031.EXE

  • Size

    816KB

  • MD5

    1817e46e5a422e9132a04db8fec73a0c

  • SHA1

    31c2f9de7b5b05cc322512fd9beadd7c7e525f6d

  • SHA256

    60969a9175951613f2c83eab67e31887eaed9429e5d03cf8ab135131a2b47054

  • SHA512

    b23c76bbf3ea1733cc4196d001a5034bf0b262bd683a26723076ce7ef653534461f9593bb0d70a037c0144695f12c4b371ffc26cde3bf69e1dcf2cc0f71eb712

  • SSDEEP

    12288:oWmaQfFJeDYFPQC1nOw6/iZyubeDmFiFVVfHVpNtrjb+Vf7SJo7lfELkNCCtPzMI:NTCfJnGbDwKNd8H

  Score

  10^/10

  xwormpersistencerattrojan

  • Xworm

    Xworm is a remote access trojan written in C#.

    trojanratxworm

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Adds Run key to start application

    persistence

  • Suspicious use of SetThreadContext

  behavioral1behavioral2