Extracted

• • Target

    2024-05-22_1e06d1f23f474c5e6ba0f279d3d3dfac_hiddentear

  • Size

    133KB

  • MD5

    1e06d1f23f474c5e6ba0f279d3d3dfac

  • SHA1

    307c847fafc7453a1050d85b6099b113a2790ef0

  • SHA256

    eb8721bfa1bcacc08b8a8712e6a7fc6d4b69776e8b592abef9539c2fc671df50

  • SHA512

    d1d5302d01fff58479385153160ab271b15f87c87cb5d7ab1df153d818ee9f109fcf8318c7622b068bb4344ab2261aca60c571e2e642d0f84e01bf15ade3c5fb

  • SSDEEP

    3072:J+oM/FJZdq/Fk96ytO/fXM+lmsolAIrRuw+mqv9j1MWLQI:C/FJaNk9Ts8+lDAA

  Score

  10^/10

  xwormpersistencerattrojan

  • Detect Xworm Payload

  • Xworm

    Xworm is a remote access trojan written in C#.

    trojanratxworm

  • Detects Windows executables referencing non-Windows User-Agents

  • Detects executables using Telegram Chat Bot

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Drops startup file

  • Executes dropped EXE

  • Adds Run key to start application

    persistence
  behavioral1behavioral2