Extracted

• • Target

    XWorm Ping Optimizer.exe

  • Size

    209KB

  • MD5

    43bb693a4d3ca23a85015b487f0db69a

  • SHA1

    4a29501c02988e111c2c6c9dccdbd135c119a4e8

  • SHA256

    f645030d125dac92a38f919cc0b134f7cba5f70f0fc5ce421a532dfe1515c22e

  • SHA512

    3694b42ef2f8ad357df9934349c100a0fd6a8386c7859ee1299bc34ba200429ac9584695a174050c425c91f120d9f40091773963e9a3427c323f614a36b7ca13

  • SSDEEP

    3072:ugUv1gB5CLa9bqqsBoO/Ya1W7T4MxK08cnNizrQxs/DrGQG3v9RfPJ:uJ1I5CLqbYlIT4MxKJzrAP

  Score

  10^/10

  xwormpersistencerattrojan

  • Detect Xworm Payload

  • Xworm

    Xworm is a remote access trojan written in C#.

    trojanratxworm

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Drops startup file

  • Executes dropped EXE

  • Adds Run key to start application

    persistence
  behavioral1behavioral2