Extracted

• • Target

    0x000d000000016d07-5.dat

  • Size

    41KB

  • MD5

    2ccd9fcce0f1c3a68e96c082d1695ba1

  • SHA1

    8b9551d5994f91d1b5b5b2e21c6ec16498c37719

  • SHA256

    61a2162fa323bb8c0e35af9f075097b9614fe0afc51980300965d50748148542

  • SHA512

    4dcebc04a7df2a4804bc4760e7fc3d6e7866e33077ee74828c0be344ea810d7df03e63ac341263321c66c615efaf76e82ff29629e94f6835c1493128e4a0cb2f

  • SSDEEP

    768:JQoFcKGxfxmVuHSvtZZt4MX79Y40DpF9qBCaQhLOF3pGno:gKGmPfIF9qO1OxpGo

  Score

  10^/10

  xwormpersistencerattrojan

  • Detect Xworm Payload

  • Xworm

    Xworm is a remote access trojan written in C#.

    trojanratxworm

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Drops startup file

  • Executes dropped EXE

  • Adds Run key to start application

    persistence
  behavioral1behavioral2