Extracted

• • Target

    hyukn.exe

  • Size

    148KB

  • MD5

    cef3a3fb369ddbf8d521a0ef2509765b

  • SHA1

    75b454f0c15579b648b2925522ed18b22f41875c

  • SHA256

    9bba4c75492332ad6ff30133a76baee064b60cf30e450c137386894986515f99

  • SHA512

    e79e34253748146ce00458c4a4d97aae875c4f40715e750a7238a9beaec425ac1d96154f2c1b27e270a503c9669608f37d565fe093c887500c08b9cd6ee2cac1

  • SSDEEP

    3072:Vp4YbV3AqHTKOZWnJtM+lmsolAIrRuw+mqv9j1MWLQg:VLbKq8nU+lDAA

  Score

  10^/10

  xwormpersistencerattrojan

  • Detect Xworm Payload

  • Xworm

    Xworm is a remote access trojan written in C#.

    trojanratxworm

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Drops startup file

  • Adds Run key to start application

    persistence
  behavioral1behavioral2