Extracted

• • Target

    20240517d9456bbb0c30222c673c9205375f5859snatch.bin

  • Size

    4.8MB

  • MD5

    d9456bbb0c30222c673c9205375f5859

  • SHA1

    1d99cfb5272f0c07ffba97135073968fc1454f88

  • SHA256

    945398c017348a3ddd4dbea5c7920f120ce2bed2a2bad117ad4be7258668218a

  • SHA512

    f18dfdd983ff46a60fbd8102aba350971502fa3c2c78f5dcec09893d38e7369134de6ea1d490f87314fcb885981313d58306b8e8a5fd26c1664e877cf1910f35

  • SSDEEP

    49152:xJqRbtKTC/Mx7NieQvCs7VOxDIt5E9id0HoCYtnl/4z6PZN:b8JKTXx7Ns70x2EPmh4O

  Score

  10^/10

  executionxwormpersistencerattrojan

  • Detect Xworm Payload

  • Xworm

    Xworm is a remote access trojan written in C#.

    trojanratxworm

  • Blocklisted process makes network request

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Drops startup file

  • Executes dropped EXE

  • Adds Run key to start application

    persistence

  • Legitimate hosting services abused for malware hosting/C2

  • Suspicious use of SetThreadContext

  behavioral1behavioral2