Extracted

Extracted

Extracted

• • Target

    COURRIER DISA.zip.html

  • Size

    216KB

  • MD5

    c376c5c91c3f93ffb913cccbe09949e6

  • SHA1

    4331d325bd138c96fe8c724e150ccf2d53f296c9

  • SHA256

    2559caf1cc1e2fc03dcc6d87bf683a2f8f8e6c3b3f4ec65009dd09c5b15cd5a9

  • SHA512

    bea51d67e36c2048ae918ccd6fe55a06bced1bf63543f333f6ad3d6d904abf55f8844582b776dd53861c8ec506f1265eb968c87a9c5ca2824f2673211812cfab

  • SSDEEP

    6144:bKJ8Rd9k1aSYUr/VO295wjF50DVp7Rydcy7OGdZ:buc9ky6f9OrIvJ0OGb

  Score

  10^/10

  xwormexecutionpersistencerattrojan

  • Detect Xworm Payload

  • Xworm

    Xworm is a remote access trojan written in C#.

    trojanratxworm

  • Blocklisted process makes network request

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Adds Run key to start application

    persistence

  • Legitimate hosting services abused for malware hosting/C2

  • Suspicious use of SetThreadContext

  behavioral1behavioral2