Extracted

• • Target

    Dragon.exe

  • Size

    245KB

  • MD5

    76a7bd2d8ea94e81708a658e920f39c0

  • SHA1

    ebb33983cedaa020d38e4b98c613a36549ba0580

  • SHA256

    d4ae56389e82b76f708e7f780fef44c79ee1b61f3512485497c3ff6ae904b53c

  • SHA512

    f914cfdd8a616bc4721dbfb2890fdfe0b2caf08b0fe8fe1070556f3bca4ff8d871d86e80e281dbcb090e1c43c1032a060059d2c6961540e6e8837d098991b072

  • SSDEEP

    3072:JS1FQCCxoPKtfLnvjKP60cq/ehN8zuUQr2jRIpzgD7ZKDwodfKdM9:JsE6CBj1UQr2jf3ZKswU

  Score

  10^/10

  xwormpersistencerattrojan

  • Detect Xworm Payload

  • Xworm

    Xworm is a remote access trojan written in C#.

    trojanratxworm

  • Xworm family

    xworm

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Drops startup file

  • Executes dropped EXE

  • Adds Run key to start application

    persistence
  behavioral1behavioral2