Extracted

• • Target

    2024-08-28_2599b7f1f17461be8a9bbe48fdc09962_hiddentear

  • Size

    308KB

  • MD5

    2599b7f1f17461be8a9bbe48fdc09962

  • SHA1

    21cbd2c4b33b02d86affb2e66b4e0b50f4bb12e9

  • SHA256

    f9aba8647ab6d32967c7d16773b77a9b9a9136bd9d3ceabe31fd4d5d3ac204e4

  • SHA512

    d3e0bee8bf6e4e206b3743fad85649e7bf9964d4e3efa9561878129dbc74afcc6625ccc186227513d0103cd5f2a9326aae34788a0b98ae8e61c8c5884fdf9522

  • SSDEEP

    3072:pBrjWFP9ZmO/OiM+lmsolAIrRuw+mqv9j1MWLQI8qJzrrtRJlhkg9V6tuAxdLfww:pBPoP9Ah+lDAADr9fjqtspmd8XCa1c

  Score

  10^/10

  xwormrattrojan

  • Detect Xworm Payload

  • Xworm

    Xworm is a remote access trojan written in C#.

    trojanratxworm

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  behavioral1behavioral2