Extracted

• • Target

    1a7d261601e4bbc160e9b96db9320d6594665aa94a8827b2e749beadd89b7590

  • Size

    59KB

  • MD5

    91b5e8f0f941632476acdb56dd13c598

  • SHA1

    34a051be4b40fa273deb322d3f6827138068e800

  • SHA256

    1a7d261601e4bbc160e9b96db9320d6594665aa94a8827b2e749beadd89b7590

  • SHA512

    7a10c304d120c71cd3b5b7e97414b3b8feb4aafc6a05a4e7d0914e1f69fdd9f717e36d063e8f0adc3d4192af69743e0c9778569bdcf8883d167f6fcb151cd3c6

  • SSDEEP

    1536:bhE2m1pT2lxGjnTd8WUeyQQl/kbrLLAAwQU0DOdN5dx/:tEp6lxinTuWHyQskbPL+IOdpx/

  Score

  10^/10

  xwormpersistencerattrojan

  • Detect Xworm Payload

  • Xworm

    Xworm is a remote access trojan written in C#.

    trojanratxworm

  • Xworm family

    xworm

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Drops startup file

  • Executes dropped EXE

  • Adds Run key to start application

    persistence
  behavioral1behavioral2