Extracted

• • Target

    XenarWare.exe

  • Size

    59KB

  • MD5

    88f95b4a2d5af8ee7893a11abecb6ace

  • SHA1

    5c349881da20c6ad25d7eabeaa41d1ae2d2ad8f2

  • SHA256

    af67708e9be6571551147ff1840a555cadd1ea0150a91001e00904a8cc7881b6

  • SHA512

    996fb4ec5a81648a2e5b706d95185b0ae73c65744a146e70bf06db076882474fc677a9095430ecbda108cbc6357ae3de4a1407eafd3a7a9e915f11476eaa0c20

  • SSDEEP

    1536:ZrPJVKjbcknWSOYvTfkWkFM79yQVo5hWyZM+c:ZLJMjbcHDdMwQKDW7

  Score

  10^/10

  upxxwormpersistencerattrojan

  • Detect Xworm Payload

  • Xworm

    Xworm is a remote access trojan written in C#.

    trojanratxworm

  • Downloads MZ/PE file

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Drops startup file

  • Executes dropped EXE

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx

  • Adds Run key to start application

    persistence
  behavioral1behavioral2