Extracted

• • Target

    04cad59e4d5175cad0c953525b7ed5f52d13a6dbda00bb5a8de4aed64ed15822

  • Size

    80KB

  • MD5

    471bfe336a60e3f5adb99494acba77cf

  • SHA1

    6a7770fbba6db6d951fe1a3839cc8ed1992fb433

  • SHA256

    04cad59e4d5175cad0c953525b7ed5f52d13a6dbda00bb5a8de4aed64ed15822

  • SHA512

    dc79cc473272713a8c1f498ac180bd8db1f1387731cbbd8ebddd9972183b16dd35789854d108976d0aabe27bae547f22b1aab849e9fb718aae1ef5e3a82cd996

  • SSDEEP

    1536:O9Wwkr6rMkYMj9EBh3tqP+be3/iZMyPMYf66rpOsvBqehiTkQ:SlplEBSP+be3/SUwOCBbQ

  Score

  10^/10

  xwormpersistencerattrojan

  • Detect Xworm Payload

  • Xworm

    Xworm is a remote access trojan written in C#.

    trojanratxworm

  • Xworm family

    xworm

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Drops startup file

  • Executes dropped EXE

  • Adds Run key to start application

    persistence

  • Legitimate hosting services abused for malware hosting/C2

  behavioral1behavioral2