Extracted

• • Target

    ad9745a30f0b4b8c8f09067b88273340N.exe

  • Size

    40KB

  • MD5

    ad9745a30f0b4b8c8f09067b88273340

  • SHA1

    c59b71dbbc1f735a2790ed9cecee9cf51856d7ef

  • SHA256

    842915fdc082ac2d547320c7911bfa28ba7fcdf41a7491575fd744bd879bdbf5

  • SHA512

    4ac714e805402362f819b0693c8d2538ecddf2d63e8e212dbd83dc82f5c77d0469e26464c28c0611b185aa2d521ef507261ed38c88ba9a6b489d331c9d42035b

  • SSDEEP

    768:SAy7yuCLGJaZr/8rMhSSYlwXDUDX+Wcv6zFPc9Y7Ophhg4bZB:SR7yutJaZXNe5SeFk9Y7Opc4bZB

  Score

  10^/10

  xwormpersistencerattrojan

  • Detect Xworm Payload

  • Xworm

    Xworm is a remote access trojan written in C#.

    trojanratxworm

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Drops startup file

  • Executes dropped EXE

  • Adds Run key to start application

    persistence
  behavioral1behavioral2