Extracted

• • Target

    dllhost.exe

  • Size

    35KB

  • MD5

    dfe1a183698d916bb80a2b3f5e16b146

  • SHA1

    75d97ebebbf43679de5b14e4d3be23d22a09ba21

  • SHA256

    a2cc98c332e44b73a8737a390dfeaaa17b08adaec271ba6d64eb2bf4c8cc5d18

  • SHA512

    2e67e15d4ad7c0c233021770de96a3cf6c95a22bed89fd31f0a872266f34a4cb3d41872de61bd929964b63170a5db5663e778a96d045b2723edce648bb750970

  • SSDEEP

    768:rDMfF7zLKYs2Byj5MuddqLa9Fk9wu/O/hr/q2O:rkF7HKYs/1hdtFk9wgO/dC2O

  Score

  10^/10

  xwormpersistencerattrojan

  • Detect Xworm Payload

  • Xworm

    Xworm is a remote access trojan written in C#.

    trojanratxworm

  • Xworm family

    xworm

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Drops startup file

  • Adds Run key to start application

    persistence
  behavioral1