Extracted

• • Target

    0x0006000000022e58-20.dat

  • Size

    38KB

  • MD5

    390e5361e31cbc929e847ac6eb52fc83

  • SHA1

    dbe0142f900ca40b01756f65f6059a073e776c37

  • SHA256

    df501e6c611c658df919bbe959e54b1080da39511a7de35ab3b5146e32584728

  • SHA512

    da8c785cf64c6d4ebfe6b4610ff51fccf5276dcfb87a5e7c4ba5dfe3ad1637ad1fc2ebff48073e5a948c2ac54dfbd97c7e60810942be80e1686a53fd892674d9

  • SSDEEP

    768:ouTCWuUSucWKwJwqv2QHF89EP6dOMhg4d:ouTspTw/2MF89EP6dOMWm

  Score

  10^/10

  xwormrattrojan

  • Detect Xworm Payload

  • Xworm

    Xworm is a remote access trojan written in C#.

    trojanratxworm

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Drops startup file

  behavioral1behavioral2