Extracted

• • Target

    windows.exe

  • Size

    332KB

  • MD5

    21b941b814ff8935b0f5b308a8c7ec9c

  • SHA1

    568e4c957b15f002eebb0bb291537e4c36c8f390

  • SHA256

    986f5d92d64819c88ae6b48f2151cc780eb0aabe7d88bd488061f5efc48588fb

  • SHA512

    dc486028a9d29f8e37454b38928222a932134ab2534b8bdf191ddd7e85da4edf39802e21de1af6de061b20a162ac14440d43320f8837f927e8e9ea354567ed18

  • SSDEEP

    6144:rd4bYBotL3mIhs8DyFPd4U1mGvEMdn7Ml/wCmCJ:rd4EBCqL4RpMi9XmCJ

  Score

  10^/10

  xwormrattrojan

  • Detect Xworm Payload

  • Xworm

    Xworm is a remote access trojan written in C#.

    trojanratxworm

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Deletes itself

  • Executes dropped EXE

  • Drops file in System32 directory

  behavioral1behavioral2behavioral3behavioral4behavioral5