Extracted

• • Target

    XWorm_v5.2.exe

  • Size

    62KB

  • MD5

    3a5d9295a7d1dad3418d52899f4c90ea

  • SHA1

    6448c5f880e2fac4a115324b9d8908f9adeaa22b

  • SHA256

    cd7b2b4e605b3d56f3c5a09df11430caf2d659d7dbe14001fd6023fd223e3414

  • SHA512

    125b06b3aca1a7f670338e18893fcb6cd97669c1dda2479111f6072fcc9ba80df03b4857fc7d30f23893383e2dbfd22b1ef28a86e5286da230286bb9aea73f59

  • SSDEEP

    1536:ot5kWNzCRWhSv0RLd1eH86rerkb1WJX4/Ox+0lXSu:g5LzCRWbhocNrkb1T/Ox+0lXSu

  Score

  10^/10

  xwormpersistencerattrojan

  • Detect Xworm Payload

  • Xworm

    Xworm is a remote access trojan written in C#.

    trojanratxworm

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Drops startup file

  • Adds Run key to start application

    persistence
  behavioral1behavioral2