Extracted

• • Target

    yaraneye.exe

  • Size

    64KB

  • MD5

    fbcf1353f836cad39412fc2dfcde4481

  • SHA1

    21422a083c98e810a22f0614761ab78eba65a245

  • SHA256

    340c8de9e85f469d40562e1f45f2789594043374a717af78712d25af2184a1aa

  • SHA512

    102252f6a6dda66b73f0101b234ee8896a813236297c52bde6c7806ce054cb6aadbab5cd51ba87cba0cae8d7140ebcb3fad1e5ee48ef7438df36840add07870c

  • SSDEEP

    1536:X7I4wz07bkSLnwvTQlbKkb8jkl7pFgqLnOufI:X7I4wwkSLnskb8jkBXLnOufI

  Score

  10^/10

  xwormpersistencerattrojan

  • Detect Xworm Payload

  • Xworm

    Xworm is a remote access trojan written in C#.

    trojanratxworm

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Drops startup file

  • Executes dropped EXE

  • Adds Run key to start application

    persistence
  behavioral1behavioral2