Extracted

• • Target

    XwormV5.3.exe

  • Size

    15.0MB

  • MD5

    d0eec7cf80098a85e6628d8834b7e153

  • SHA1

    aef442dbe12344111955d8a3b92427f03a8808b5

  • SHA256

    120286ca0a3f1e3805d5268c3110ac338b1d086ae5487bd25fdf4e1d917b1bce

  • SHA512

    50db066cc6e7402f635c73d4f770d0202b6c112db56a9d858c42df4f5816a07679f8f6c52efad0ce609390b792f4bd6887f39d5a9fddbd4ede912fb4fafcfa3b

  • SSDEEP

    393216:iwTnaP1qOj5Dg/lgp8BOVF3DS2k4tUUi6AreM:xTavq/q8w3DS2k4KNFr/

  Score

  10^/10

  xwormpersistencerattrojan

  • Detect Xworm Payload

  • Xworm

    Xworm is a remote access trojan written in C#.

    trojanratxworm

  • Xworm family

    xworm

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Drops startup file

  • Executes dropped EXE

  • Adds Run key to start application

    persistence
  behavioral1behavioral2