Extracted

• • Target

    dd7eeabf429f5446bab2e752cc32ad67.exe

  • Size

    705KB

  • MD5

    dd7eeabf429f5446bab2e752cc32ad67

  • SHA1

    4316cb563c1e29c5aad6e6672a3f6c0c8809d414

  • SHA256

    c80b0e1302fb244da88400f1ff9a8063659cac5d073824a34993bcad59d731b8

  • SHA512

    91dd19c5950b7bd83abf3b4b3e494dc0567c7a70612b561988a28c0f72a04bf3f5a8067733fe8ee2e1a374ba5d46d5444392e6072b8064d76ece2d42ba6ba05b

  • SSDEEP

    12288:hhZDn5uMIWx8oohmQBI7HYOAXy3HSKaKUbF0w+EQ:nZrnJsI74jXSSFPF0r

  Score

  10^/10

  xwormpersistencerattrojan

  • Detect Xworm Payload

  • Xworm

    Xworm is a remote access trojan written in C#.

    trojanratxworm

  • Blocklisted process makes network request

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Drops startup file

  • Executes dropped EXE

  • Loads dropped DLL

  • Adds Run key to start application

    persistence

  • Suspicious use of SetThreadContext

  behavioral1behavioral2