Extracted

• • Target

    QZK RAT Free.zip

  • Size

    135.8MB

  • MD5

    137b00100757794f85bfd997700ee1e8

  • SHA1

    0d558b31fbe2e90babd7cdd4058d53ec66fa60de

  • SHA256

    5690987418e7898137bb9f8e706d3ff8f196b1dc612be983012524235f64f6af

  • SHA512

    f7283e2e1cdbff26e4c2ecca2f990c72d0703412472cccf0212c81bbf9a0979ee2e3ac6c55f1324cbab98b27392776f49319e6bbc84d7784138d89f29353bb8e

  • SSDEEP

    3145728:AgC3YNSUW9fG+SbOeuzqHc3C6JDnnTj/Xi8BiVsspOMZ0kr+tQzapQG8KAt086UD:AgCasqOeLc3C6JbP/XiTo3krnglgD

  Score

  10^/10

  xwormagilenetrattrojan

  • Detect Xworm Payload

  • Xworm

    Xworm is a remote access trojan written in C#.

    trojanratxworm

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Obfuscated with Agile.Net obfuscator

    Detects use of the Agile.Net commercial obfuscator, which is capable of entity renaming and control flow obfuscation.

    agilenet

  • Uses the VBS compiler for execution

  • Suspicious use of NtSetInformationThreadHideFromDebugger

  behavioral1