Extracted

• • Target

    XRATClient.exe

  • Size

    354KB

  • MD5

    561def00a7bcf0e79729aaa63a0ca655

  • SHA1

    a0490d9a12b0e125889b11ab6880a75b9f56cf1b

  • SHA256

    6fa4e5b526be2acf1ea59d961cf62590c1e438745b0cd9180c45e86a4d637ae1

  • SHA512

    d9f1909080e51acb48f3dd724343c4721ea891e54e46d8e5fe5f390112d8f4f96c9455c9347be24d4f6c94c03dd6c6d549be5ccafbc0d2db98a50ef2589ff525

  • SSDEEP

    3072:TcKLbgaYXPPfUvubWxU5ImSO2qqk4dGR:Tc5a238mb

  Score

  10^/10

  xwormpersistencerattrojan

  • Detect Xworm Payload

  • Xworm

    Xworm is a remote access trojan written in C#.

    trojanratxworm

  • Drops startup file

  • Executes dropped EXE

  • Adds Run key to start application

    persistence
  behavioral1