Extracted

• • Target

    5c1346a2797c9c8b47972115bf2b91dd440737b9cf9e6b0a25fe3193b23ab440

  • Size

    35KB

  • MD5

    0d5ea6652d99bf3f17218c031f012e01

  • SHA1

    cfff73f3aaf1660f3149a6321b26cf9a28f82580

  • SHA256

    5c1346a2797c9c8b47972115bf2b91dd440737b9cf9e6b0a25fe3193b23ab440

  • SHA512

    07568853181443a2c0ea128131bdd2b38946fa6b41322395fd929933d14677b10e2583547e4ee7a9e8a20331e817d88098cebdaf213ec57b586c3e8dad19d869

  • SSDEEP

    768:5Me7htYzhvffz3j0qoo9Fk942hO/hC/q+E:j7htYzhL3AkFk942hO/MC+E

  Score

  10^/10

  xwormpersistencerattrojan

  • Detect Xworm Payload

  • Xworm

    Xworm is a remote access trojan written in C#.

    trojanratxworm

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Drops startup file

  • Executes dropped EXE

  • Adds Run key to start application

    persistence
  behavioral1behavioral2