Extracted

• • Target

    c1b2508911195d25524604f8fd72691bf55354fdb0e5c7cceeb55e0489335050

  • Size

    582KB

  • MD5

    17f138c7944f0fe501cabf1c9b613959

  • SHA1

    8f121cfde56155202580b4f9068fad786d8751e3

  • SHA256

    c1b2508911195d25524604f8fd72691bf55354fdb0e5c7cceeb55e0489335050

  • SHA512

    1c6a4b1b89efac547d53bddc0f3686cd28ad2d8679c8e8620a3505bb51166778cf2c8827e8a1fd6f1e73cdaa50860fe63b56eec95d45f42424a9893b9ded0d25

  • SSDEEP

    12288:5rLLrjj5JbC7rDh7ht0iJpMjS00bSVYjk/EgTjB/nnPCVu6I/:5r/rjVJbC7vztZJIS002Kgp/nn6V9g

  Score

  10^/10

  xwormrattrojan

  • Detect Xworm Payload

  • Xworm

    Xworm is a remote access trojan written in C#.

    trojanratxworm

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  behavioral1behavioral2