Extracted

• • Target

    Cleaner.exe

  • Size

    172KB

  • MD5

    9229077d00bad648e91aaf30bd096567

  • SHA1

    83eba361175f6c5dd71f740d527ab853a504d15b

  • SHA256

    1eca23db92c0319d414040c2ff9a240d57f806290e1f0238d696fea761c5d948

  • SHA512

    a8d6ac08eb8a2d74791238bfd73cda0062ac4a706bba6a61472efd4a062e2e611661a931d0d14a7edd52a833be830c254dbc14b184ae30a013687d547bc105a7

  • SSDEEP

    3072:IuAN13vRxKBL+b0kb1zehFjO/G16Bz65/M6If+3Js+3JFkKeTnZ:KRYib0y1ihf16xBt25

  Score

  10^/10

  xwormpersistencerattrojan

  • Detect Xworm Payload

  • Xworm

    Xworm is a remote access trojan written in C#.

    trojanratxworm

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Drops startup file

  • Executes dropped EXE

  • Adds Run key to start application

    persistence
  behavioral1behavioral2