Extracted

• • Target

    AVPGameProtect.exe

  • Size

    2.0MB

  • MD5

    ae8302cc3743e0cf591462ff99323b48

  • SHA1

    a22a1376581511399d1ba6c19b9adf353b9a8deb

  • SHA256

    65c98bb84510c6ef706ab17912ecaafcc433b49a7c6c10efb02cfdfe4cb0ba47

  • SHA512

    e27cf857ca75c5f2e07e15c9024255ad820ef958e2600a227b33949f70dafbd9a0159adc1146899a6c48e20a5627e161ca4aac74077a9206a5b4d8329f9ae392

  • SSDEEP

    49152:CQIG3ye106F68OmKm9lsACXfgWmG+HYRTu:0QABLqsAUDmG+5

  Score

  10^/10

  xwormransomwarerattrojan

  • Detect Xworm Payload

  • Xworm

    Xworm is a remote access trojan written in C#.

    trojanratxworm

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Sets desktop wallpaper using registry

    ransomware
  behavioral1behavioral2