Extracted

• • Target

    9b520c079411cbfeec0cf3ff1dd32bd0N.exe

  • Size

    111KB

  • MD5

    9b520c079411cbfeec0cf3ff1dd32bd0

  • SHA1

    d53cef633fec92944221f228d3de63272fdad3d1

  • SHA256

    06fe00e31bd25f1dc0db0b5b068d329491c2fe543cc06655a3dbdf69ca1c3b3b

  • SHA512

    be9bd83ea11073b9039ebff6e18007ca8df437a0ee3c31d223fd8100ad7331dc28c1e95b6b1a372538e46c48fa988613d3e522d8faba9cd6c9581f3a2f327c9f

  • SSDEEP

    1536:Y+qFrwBul6SqYK1Q9yEnTI4GZjzQwK5WW7VCn6Ky7FAmu3wtBUniymeq07sZPSTy:vqpwBzSVaQ9yoT2e5BV0WUniyimy1

  Score

  10^/10

  xwormpersistencerattrojan

  • Detect Xworm Payload

  • Xworm

    Xworm is a remote access trojan written in C#.

    trojanratxworm

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Drops startup file

  • Executes dropped EXE

  • Adds Run key to start application

    persistence
  behavioral1behavioral2