Extracted

• • Target

    3f1e8e3609e6ffd53453d5ce0ca33dc7eaf06e55085d7f6c43d0c4b6df1f974f.exe

  • Size

    166KB

  • MD5

    67183ea2fdfbaace4c265de91e218c59

  • SHA1

    a66c33b7d7d27bc5153f53d672b2f7c7d36c2ae8

  • SHA256

    3f1e8e3609e6ffd53453d5ce0ca33dc7eaf06e55085d7f6c43d0c4b6df1f974f

  • SHA512

    0eca1d1f216e81c6000ab24d9c25f25ed5f6d7a2d5b97c73093ffb771c399e8b98e1b95890ff0d0326a6f00f9c2606947c03aa91a30c9b7d0106b34dc0978622

  • SSDEEP

    3072:ubYexkjTk/btjQAzsOSrDGM+lmsolAIrRuw+mqv9j1MWLQZ:u0e62byAzw+lDAA

  Score

  10^/10

  xwormpersistencerattrojan

  • Detect Xworm Payload

  • Xworm

    Xworm is a remote access trojan written in C#.

    trojanratxworm

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Drops startup file

  • Adds Run key to start application

    persistence
  behavioral1behavioral2